# User can borrow DOLA indefinitely without settling DBR deficit by keeping their debt close to the allowed maximum

Borrowers keep collateral surplus under ~$100 so forceReplenish is unprofitable, letting them repay and exit with an unsettled DBR deficit.

- Payout: Audit contest
- Severity: medium
- Program: Inverse Finance
- Found by: Holmgren
- Disclosed: 2022-12-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-10-inverse#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** Market.sol lending market (repay/forceReplenish)
**Root cause:** forceReplenish cannot push debt underwater and repay() does not require a zero DBR deficit, so a small collateral surplus makes replenishment economically unattractive while the deficit grows unbounded.
**Steps:**
1. Deposit collateral and borrow close to the max allowed DOLA.
2. Keep withdrawing/depositing collateral so surplus stays under ~$100 (or ~$5 if gov replenishes).
3. Accrue arbitrarily large DBR deficit while no third party finds forceReplenish profitable.
4. Call `repay()` to clear debt without settling the DBR deficit.
5. Withdraw all collateral.
**How found:** Reasoned about the economics of forceReplenish: it cannot push debt underwater and repay ignores deficit, so a small surplus makes replenishment unprofitable, enabling indefinite interest-free borrowing.
**Exploitation:** Attacker borrows DOLA interest-free, maintains a dust collateral surplus below the replenishment break-even (~$100 at current gas), repays debt and withdraws collateral, leaving an unsettled DBR deficit.
**Insight:** When a penalty/incentive mechanism is only triggered by third parties, check whether the attacker can keep the trigger value below the gas/incentive break-even; dust-sized surpluses can make enforcement economically irrational.