# repayDebt in Vault.sol could DOS functionality for markets

Anyone can repay any borrower's debt in Vault.sol, zeroing debts while totalDebt underflows, DOSing market borrowing.

- Payout: Audit contest
- Severity: medium
- Program: InsureDAO
- Found by: p4st13r4
- Disclosed: 2022-03-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-insure-findings/issues/126
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AM-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** Vault.sol repayDebt() debt accounting
**Root cause:** repayDebt() lets any caller repay up to totalDebt for a target, zeroing debts[_target] and decrementing totalDebt, but other borrowers' debts remain; repaying all borrowers makes totalDebt underflow when markets try to decrease it.
**Steps:**
1. Call `repayDebt()` for each borrower with amount equal to their debt, zeroing `debts[_target]` and reducing `totalDebt` to zero.
2. Market later attempts to decrease `totalDebt` for a borrower, causing underflow revert.
3. Borrowing functionality in markets is DOSed.
**How found:** Code reading of repayDebt() in Vault.sol noting it zeroes per-borrower debt but decrements shared totalDebt, leaving inconsistency when all debts repaid.
**Exploitation:** Attacker (generous user) repays all borrowers' debts via repayDebt(), driving totalDebt to zero; subsequent market debt-decrease operations underflow and revert, blocking borrowing.
**Insight:** When a shared aggregate counter (totalDebt) is decremented per-borrower repayment, check whether an external actor can zero individual debts without proportionally reducing the aggregate, leaving it desynced for later underflow.