# Repaying a line of credit with a higher than necessary claimed revenue amount will force the borrower into liquidation

SpigotedLine.useAndRepay underflows credit.principal in an unchecked block when repayment exceeds principal+interest, forcing the secured line into immediate liquidation.

- Payout: Contest reward
- Severity: high
- Program: Debt DAO
- Credited: berndartmueller
- Disclosed: 2023-02-07
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-debtdao-findings/issues/461
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AH-06
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:liquidation

**Target:** SpigotedLine.useAndRepay / CreditLib.repay (Solidity credit line contract)
**Root cause:** CreditLib.repay computes principalPayment = amount - interest and subtracts it from credit.principal inside an unchecked block without verifying amount <= principal + interestAccrued, so overpayment underflows principal to near 2^256-1.
**Steps:**
1. Borrow 1 ether of revenueToken via _borrow(id, lentAmount).
2. Claim and trade 2 ether of revenue via `line.claimAndTrade(revenueToken, tradeData)` with tradeData `trade(address,address,uint256,uint256)` for largeRevenueAmount=2 ether.
3. Call `line.useAndRepay(largeRevenueAmount)` (callable by lender or borrower) with amount=2 ether > principal 1 ether.
4. Observe credit.principal underflow to 2^256-1 - (2 ether - 1 ether) instead of reverting.
**How found:** Code review of CreditLib.repay noticed the unchecked block and that principalPayment (amount - interest) is subtracted from credit.principal without a bound check, unlike LineOfCredit.depositAndRepay which requires amount <= principal + interestAccrued.
**Exploitation:** Lender (or borrower) calls useAndRepay with an amount exceeding principal+interest; the unchecked subtraction wraps principal to ~2^256-1, immediately triggering liquidation of the secured line and making repayment economically infeasible.
**Insight:** In Solidity, audit every `unchecked` block for subtraction where the subtrahend derives from a user-supplied amount; compare against sibling functions (depositAndRepay) that do bound-check the same quantity to spot the missing guard.