# Users can avoid paying fees if they manage to update their accrued fees periodically

DBR.accrueDueTokens rounds accrued interest to zero for small debts but still updates lastUpdated, letting borrowers who call it every block pay no interest.

- Payout: Audit contest
- Severity: medium
- Program: Inverse Finance
- Found by: RaoulSchaffranek
- Disclosed: 2022-12-20
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2022-10-inverse#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window vuln:accounting-error vuln:precision-loss

**Target:** DBR.sol accrueDueTokens interest accrual
**Root cause:** accrued = (block.timestamp - lastUpdated[user]) * debt / 365 days uses integer division that rounds down to 0 for small debt*elapsed products, yet lastUpdated[user] is still set to block.timestamp, discarding the un-accrued time.
**Steps:**
1. Borrow a small amount so debt < 365 days / block time (e.g. `2_627_999` wei with 12s blocks).
2. Every block (12s), call `dbr.accrueDueTokens(user)` permissionlessly.
3. Each call computes `accrued = 12 * debt / 31_536_000 = 0` and resets `lastUpdated[user]`, so `dueTokensAccrued` never grows.
4. Repeat for the loan duration; `dbr.deficitOf(user)` stays 0 (Foundry test `testFail_free_borrow` warps 12s and calls accrue for 1h).
5. Scale by splitting a large loan into many loans each capped at `365 days / 12s - 1`.
**How found:** Reading accrueDueTokens, noticed lastUpdated is updated unconditionally even when accrued rounds to 0, then computed the debt*elapsed threshold where integer division truncates and modeled gas economics per network.
**Exploitation:** Attacker borrows DOLA split into many tiny positions (each ≤ ~2.6M wei at 12s blocks) and batches accrueDueTokens calls for all of them each block, keeping elapsed*debt below 365 days so interest rounds to zero; gas cost currently exceeds saved interest on mainnet but becomes viable on L2s, faster block times, or low-decimal high-value assets like WBTC (only ~39 loans per 1 WBTC).
**Escalation:** Splitting a massive loan into many sub-threshold loans and batching updates in one transaction to amortize gas; risk grows with asset price and fewer token decimals.
**Insight:** In accrual/index contracts, check whether a zero-result rounding update still advances the timestamp/cursor — truncation plus unconditional checkpointing silently forgives debt; test with block-time-sized elapsed intervals and minimal debt.