# Can force borrower to pay huge interest

NFTLoanFacilitator treats requested loan amount as a minimum, letting a lender match far higher, forcing borrower to pay interest on the inflated principal or risk collateral.

- Payout: Audit contest
- Severity: high
- Program: Backed Protocol
- Credited: cmichel
- Disclosed: 2022-04-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-backed-findings/issues/24
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-backed%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** NFTLoanFacilitator.sol lend/loan matching
**Root cause:** The borrower's requested loan amount is used as a minimum rather than a maximum, so a lender can match the loan at an arbitrarily higher principal; interest and origination fee accrue on the full amount.
**Steps:**
1. Borrower requests 10k USDC against a 350k BAYC collateral.
2. Lender calls `lend` matching with 350k USDC (up to collateral value).
3. Loan principal becomes 350k; borrower owes interest and origination fee on 350k.
4. Borrower must repay inflated interest or default and lose the 350k collateral.
**How found:** Code reading of NFTLoanFacilitator.sol#L148 noting the loan amount is enforced as a min, then reasoning about illiquid collateral forcing borrowers to over-collateralize and accept inflated principal.
**Exploitation:** A malicious lender matches the loan at the maximum the collateral supports, inflating principal and interest; borrower either pays ~35x effective interest on the intended amount or defaults, letting lender seize collateral with limited risk.
**Escalation:** Combining unbounded loan amount with interest rate and origination fee (max 5%) lets a lender grief the borrower and gain a chance to seize collateral.
**Insight:** When a 'requested amount' is enforced as a minimum in a matching/lend flow, check whether a counterparty can inflate principal and shift interest/fees onto the requester; min-vs-max semantics on user-specified amounts are a recurring griefing vector.