# Deny of service in AccountantDelegate.sweepInterest

sweepInterest requires treasury cNote balance to be zero after redeem; anyone sending 1 cNote to treasury permanently bricks interest sweeping.

- Payout: Contest reward
- Severity: high
- Program: Canto
- Credited: 0x1f8b
- Disclosed: 2022-10-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-NewBlockchain-v2-findings/issues/28
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-canto-v2%3AH-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** AccountantDelegate.sweepInterest (Solidity lending market contract)
**Root cause:** amtToSweep is computed from address(this) balance, but the post-redeem invariant requires cnote.balanceOf(treasury)==0; any external cNote transfer to treasury breaks that invariant permanently.
**Steps:**
1. Call `sweepInterest` logic: `cnote.transfer(treasury, amtToSweep)` then `Treas.redeem(address(cnote), amtToSweep)`
2. Observe final check `require(cnote.balanceOf(treasury) == 0)`
3. Attacker sends 1 cNote directly to `treasury` address
4. Any subsequent `sweepInterest` call reverts with `AccountantDelegate::sweepInterestError`
**How found:** Code reading of sweepInterest: noticed amtToSweep computed from address(this) balance while the invariant checks treasury balance, a mismatch exploitable by external token transfer.
**Exploitation:** Griefer transfers a single cNote token to the treasury address; because amtToSweep is derived from the contract's own balance and not the treasury's, the redeem never clears the attacker's dust, so the zero-balance require always fails, permanently blocking interest sweeps and trapping yield.
**Insight:** When a function asserts a post-condition on a balance it does not fully control (e.g. treasury==0), check whether an outsider can donate dust to break the invariant; compare the source of the computed amount against the address whose balance is asserted.