# Builder can halve the interest paid to a community owner due to arithmetic rounding

Builder repays tiny amount just before 2-day mark so noOfDays rounds down to 1, halving interest owed to community owner.

- Payout: Contest reward
- Severity: high
- Program: Rigor Protocol
- Credited: scaraven
- Disclosed: 2022-09-12
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-08-rigor-findings/issues/180
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-rigor%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** Community.sol returnToLender interest accrual
**Root cause:** noOfDays truncates (block.timestamp - lastTimestamp)/86400 to integer days, but lastTimestamp is updated to now regardless, so sub-day remainders are discarded each repayment.
**Steps:**
1. Community owner lends 500_000 tokens at 10% APR to builder.
2. Builder calls returnToLender with 0.000001 tokens at `lastTimestamp + 2*86400 - 1`.
3. `noOfDays` = (172799)/86400 truncates to 1.
4. Interest charged = 500000*100*1/365000 = 136 tokens instead of ~273.9 for 2 days.
5. lastTimestamp resets to now, discarding the ~1 day remainder; repeat every ~2 days.
**How found:** Code reading of returnToLender interest formula; noticed integer division of elapsed seconds by 86400 combined with unconditional lastTimestamp update discards remainder.
**Exploitation:** Builder repeatedly repays dust just under each 2-day boundary, resetting lastTimestamp while only 1 day of interest accrues, effectively halving APR paid while advertising high APR to attract funding.
**Insight:** When a timestamp is reset after a truncated time-delta computation, the discarded remainder is a repeatable value leak; check any accrual that floors elapsed time then resets the clock.