# VaultTracker miscalculates compounding interest

VaultTracker computes new interest only on notional, ignoring previously accrued redeemable interest, so nToken holders earn less compounding yield than their cTokens actually generate.

- Payout: Contest reward
- Severity: medium
- Program: Swivel
- Credited: GimelSec
- Disclosed: 2022-09-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-07-swivel-findings/issues/136
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-swivel%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error

**Target:** VaultTracker.sol interest accounting (addNotional/removeNotional/redeemInterest/transferNotionalFrom)
**Root cause:** Interest is computed as yield * vlt.notional / 1e26, excluding already-accrued vlt.redeemable from the base, so prior interest never compounds.
**Steps:**
1. Deposit 5 underlying at cToken exchangeRate 5 -> notional=5, redeemable=0, 1 cToken held.
2. Deposit 10 at exchangeRate 10 -> yield=1e26, interest=5, notional=15, redeemable=5, 2 cTokens held.
3. Deposit 20 at exchangeRate 20 -> yield=1e26, interest=15 (on notional 15, not 20), notional=35, redeemable=20, 3 cTokens held.
4. Actual value of 3 cTokens at rate 20 is 60, but tracked notional+redeemable = 55; 5 units of yield lost.
**How found:** Code reading of addNotional's interest formula; noticed the yield base is vlt.notional only, then constructed a multi-deposit example with rising exchange rates to show tracked value diverges from actual cToken value.
**Insight:** When auditing interest accounting, check whether the accrual base includes already-credited interest; a non-compounding formula silently under-credits users and is easy to miss because each individual step looks correct.