# Interest accrued could be zero for small decimal tokens

Interest formula truncates to zero for low-decimal tokens like EURS, letting borrowers repay frequently to evade all interest.

- Payout: Audit contest
- Severity: medium
- Program: Sublime
- Found by: hickuphh3
- Disclosed: 2022-07-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-sublime-findings/issues/10
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-sublime%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass vuln:precision-loss

**Target:** PooledCreditLine.sol interest accrual calculation
**Root cause:** Interest is computed as principal*rate*timeElapsed/YEAR/SCALING_FACTOR with integer division; for small-decimal tokens and short elapsed times the result truncates to zero.
**Steps:**
1. Use a whitelisted low-decimal token such as EURS (2 decimals).
2. Borrow 10_000 EURS = 1_000_000 base units at 5% rate (`5e17`).
3. Update principal (borrow/repay) every ~63s: `1_000_000 * 5e17 * 63 / (86400*365) / 1e18 = 0.99885` truncates to 0.
4. Repeat frequent tiny borrow/repay updates so accumulated interest stays zero.
**How found:** Code review of the interest formula spotted integer division by YEAR_IN_SECONDS and SCALING_FACTOR; reasoned that low-decimal tokens combined with short elapsed time yield sub-1 results that truncate to zero.
**Exploitation:** Borrower repeatedly triggers principal updates within the truncation window (~63s for the example) so each accrual rounds to zero, paying no interest over the loan lifetime.
**Insight:** When auditing interest/fee accrual, compute the minimum principal*rate*time product that rounds to 1 and check whether low-decimal whitelisted assets or frequent update calls fall below that threshold.