# LenderPool: Principal withdrawable is incorrectly calculated if start() is invoked with non-zero start fee

LenderPool computes principal withdrawable against fee-reduced borrowLimit, so with a non-zero start fee lenders' withdrawable amount exceeds available principal and withdrawals revert.

- Payout: Audit contest
- Severity: high
- Program: Sublime
- Found by: hickuphh3
- Disclosed: 2022-07-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-sublime-findings/issues/19
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-sublime%3AH-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** LenderPool.sol pooled credit line accounting
**Root cause:** _calculatePrincipalWithdrawable divides by borrowLimit, which is reduced by the start fee, while totalSupply reflects full deposits, breaking the 1:1 ratio and overstating withdrawable principal.
**Steps:**
1. Deploy pooled credit line with 1% startFee; sole lender Alice deposits `100_000` tokens so `totalSupply[_id]=100_000`.
2. Call `start()`; borrowLimit becomes `99_000` due to fee.
3. Borrower borrows zero; Alice calls withdraw liquidity.
4. `_calculatePrincipalWithdrawable` returns `99_000 * 100_000 / 99_000 = 100_000`, exceeding available `99_000`, so withdrawal reverts.
**How found:** Code reading of _calculatePrincipalWithdrawable noticed the denominator uses borrowLimit (fee-reduced) while numerator uses share balance from totalSupply (full deposits), breaking the assumed 1:1 ratio.
**Insight:** When share/principal math divides by a limit that fees or borrows mutate, check whether the share denominator still matches the original deposit base; fee deductions silently break 1:1 assumptions.