# Wrong APR can be used when project is unpublished and published again 

Republishing a project overwrites its APR before accrued interest is settled, so old debt is charged at the new rate, over- or under-charging interest.

- Payout: Contest reward
- Severity: high
- Program: Rigor Protocol
- Credited: Lambda
- Disclosed: 2022-09-12
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-rigor-findings/issues/83
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-rigor%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Community.sol smart contract (publish/unpublish, claimInterest)
**Root cause:** Publishing a project updates the community APR without first calling claimInterest, so interest accrued during the unpublished period is computed using the new APR rather than the rate in effect when the debt was incurred.
**Steps:**
1. Publish Project A in community I with APR 3%; lend 1,000,000 USD (`lentAmount`=1,000,000).
2. Unpublish Project A; `lentAmount` remains 1,000,000 and `lastTimestamp` is not updated.
3. Wait one year with no `repayLender`, `reduceDebt`, or `escrow` calls, so interest is never accrued.
4. Republish Project A in the same community with new APR 5%.
5. Call `lendToProject` for another 1,000,000 USD, triggering `claimInterest` which uses the new 5% APR on the prior year's debt.
6. Observe interest of 50,000 USD instead of the correct 30,000 USD.
**How found:** Code reading of Community.sol#L267: noticed publish overwrites APR while lentAmount can be non-zero and lastTimestamp stale, so claimInterest later applies the new rate to old debt.
**Exploitation:** A borrower unpublishes a project carrying outstanding debt, waits while interest accrues unbooked, then republishes at a lower APR before any interest settlement, causing claimInterest to under-charge the accrued period (or over-charge if APR rises).
**Insight:** When a rate/config field is mutable and interest is lazily accrued via lastTimestamp, check every write to that field for a missing settle-first call; unpublish/republish cycles are a classic window to swap rates against unbooked debt.