# PooledCreditLine: termination likely fails because _principleWithdrawable is treated as shares

PooledCreditLine.terminate() passes a borrowAsset-denominated principal amount as a share count to withdrawShares, causing wrong or failed withdrawals.

- Payout: Audit contest
- Severity: high
- Program: Sublime
- Found by: hickuphh3
- Disclosed: 2022-07-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-sublime-findings/issues/21
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-sublime%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** PooledCreditLine LenderPool terminate() / SavingsAccount.withdrawShares
**Root cause:** _principalWithdrawable is computed in borrowAsset units (notBorrowed * totalSupply / borrowLimit) but passed to withdrawShares, which expects a share amount, conflating asset units with ERC1155 share units.
**Steps:**
1. Open a pooled credit line so sharesHeld and totalSupply[_id] exist
2. Call terminate(_id, _to) on LenderPool
3. Observe _principalWithdrawable = _notBorrowed.mul(totalSupply[_id]).div(_borrowedTokens) is in borrowAsset units
4. withdrawShares receives that value plus _totalInterestInShares as share count, mismatching actual shares held
5. Fix: withdraw _sharesHeld instead, and restrict terminate() to ACTIVE/EXPIRED states
**How found:** Code reading of terminate() in LenderPool.sol, noticing the unit mismatch between the borrowAsset-denominated _principalWithdrawable and the share-denominated withdrawShares parameter.
**Exploitation:** Not a direct theft path described; terminate() either reverts or withdraws an incorrect share amount, breaking termination and potentially misallocating lender funds.
**Insight:** When a function mixes a computed asset amount with a share-based withdrawal API, check the denomination of every variable at the call boundary; ERC4626/ERC1155 share-vs-asset confusion is a recurring bug class.