# CDP.sol update overwrites user's credit on every positive increment

CDP.sol's update() overwrote totalCredit with only the latest increment instead of adding to it, permanently losing accumulated yield credit for positions.

- Payout: Audit contest
- Severity: high
- Program: yAxis
- Found by: harleythedog
- Disclosed: 2022-01-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-yaxis-findings/issues/31
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-yaxis%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** CDP.sol library in Alchemix v3 contracts (Solidity smart contract)
**Root cause:** update() assigns `_self.totalCredit = _earnedYield.sub(_currentTotalDebt)` instead of adding the new increment to the existing totalCredit, so each call replaces prior accumulated credit.
**Steps:**
1. Read `CDP.sol` line 39: `_self.totalCredit = _earnedYield.sub(_currentTotalDebt);`
2. Compare with `getUpdatedTotalCredit` which returns `_self.totalCredit + (_unclaimedYield - _currentTotalDebt)`, showing credit is meant to accumulate
3. Call `update()` repeatedly on a position with zero debt earning yield; observe totalCredit is overwritten with only the latest increment each time
**How found:** Manual code inspection; noticed the assignment (not +=) on line 39 and cross-checked against getUpdatedTotalCredit's additive formula to confirm intent mismatch.
**Insight:** When a state variable is meant to accumulate, grep for bare `=` assignments to it and compare against any getter that computes the same quantity additively; a mismatch reveals an overwrite bug.