# Bad debts should not continue to accrue interest

JPEG'd NFTVault accrues interest on uncollectible bad debt, minting unbacked stablecoin each collect() and diluting peg.

- Payout: Audit contest
- Severity: high
- Program: JPEG'd
- Credited: WatchPug
- Disclosed: 2022-06-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-jpegd-findings/issues/167
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-jpegd%3AH-09
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:liquidation vuln:oracle-manipulation

**Target:** NFTVault.sol liquidation and interest accrual
**Root cause:** Liquidation requires full debt repayment, so underwater positions become bad debt, yet accrue() still counts their interest as collectible and mints stablecoin against it.
**Steps:**
1. Alice borrows 10,000 USD against NFT #1 (creditLimitRate 60%, liquidationLimitRate 50%, APR 10%).
2. NFT value drops to 10,000 USD; liquidators refuse to repay 11,000 USD debt.
3. Position is now bad debt but remains in totalDebtPortion.
4. DAO calls collect(); accrue() mints ~1,000 stablecoin of interest on the unbacked debt.
5. Repeat each year: 1,100, then more unbacked stablecoin minted.
**How found:** Code review of liquidate() requiring full debtAmount burn, combined with accrue()/collect() minting interest over totalDebtPortion without excluding uncollectible positions; reasoned through a market-crash scenario.
**Exploitation:** No direct theft; protocol-level accounting flaw. As bad debt share grows, collect() mints stablecoin not backed by repaid loans, undermining stablecoin authenticity/peg.
**Insight:** In lending protocols, check whether interest accrual and fee collection exclude positions that can never be liquidated profitably; full-repayment-only liquidation plus interest minting creates unbacked seigniorage.