#  AccountantDelegate: sweepInterest function will destroy the cnote in the contract.

AccountantDelegate.sweepInterest transfers all cNote to address(0), burning interest-bearing collateral and blocking user repayments.

- Payout: Audit contest
- Severity: high
- Program: Canto
- Found by: cccz
- Disclosed: 2022-10-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-newblockchain-findings/issues/89
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-canto%3AH-03
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity vuln:accounting-error vuln:business-logic

**Target:** AccountantDelegate.sweepInterest in lending market
**Root cause:** sweepInterest calls cnote.transfer(address(0), CNoteBalance) instead of redeeming, destroying the contract's cNote holdings.
**Steps:**
1. User borrows note tokens; AccountantDelegate holds cNote collateral.
2. User repays; cNote is destroyed and note transferred to AccountantDelegate.
3. Call `sweepInterest()`; it executes `cnote.transfer(address(0), CNoteBalance)`.
4. All cNote in contract is burned, blocking repayment and breaking interest accounting.
**How found:** Code review of sweepInterest noticed transfer to address(0) instead of redeem, an unconditional asset-destruction programmer mistake.
**Exploitation:** Any caller of sweepInterest irreversibly burns the contract's cNote balance, preventing users from repaying note tokens and corrupting future interest calculations.
**Insight:** In lending/accounting contracts, check that interest-sweep and collateral-handling functions redeem rather than transfer tokens to address(0); a single wrong recipient burns protocol-held interest-bearing assets.