# The lender can draw out extra credit token from borrower's account

Reentrancy in LineOfCredit._close() via ERC777-style token hook lets lender re-enter close() repeatedly, draining extra interest from borrower and underflowing count.

- Payout: Contest reward
- Severity: medium
- Program: Debt DAO
- Credited: KingNFT
- Disclosed: 2023-02-07
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-debtdao-findings/issues/176
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AM-06
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reentrancy

**Target:** LineOfCredit / SecuredLine close() with hook-enabled ERC20 credit token
**Root cause:** _close() sends tokens to the lender before finalizing state, and the token's transfer hook lets the lender re-enter close() while credit state is still live; count is decremented each re-entry causing underflow.
**Steps:**
1. Deploy a credit token with an _afterTokenTransfer hook (ERC777-like) that calls back into registered addresses.
2. Borrower and lender addCredit with this hook token; lender registers itself as hook receiver.
3. Lender calls `line.close(id)`; _close() calls LineLib.sendOutTokenOrETH to lender, triggering tokensReceived hook.
4. In tokensReceived, lender re-deposits `deposit` via `token.transfer(address(line), deposit)` and calls `line.close(id)` again, up to ATTACK_COUNT times.
5. Each re-entry pays out deposit+interestRepaid again, netting extra interestAccrued per iteration; count underflows to MAX_INT - ATTACK_COUNT + 1.
**How found:** Code review of _close() noting the external token transfer to lender occurs before state finalization, combined with awareness of ERC777/imBTC-style reentrancy via token hooks.
**Exploitation:** Lender registers a hook on the credit token, calls close(), and on each token-received callback re-sends the deposit back to the line and re-invokes close(), collecting interestAccrued repeatedly. Net gain = interestAccrued * ATTACK_COUNT; line count underflows so status can never reach REPAID and borrower collateral is stuck.
**Escalation:** Repeated re-entry (10x in PoC) multiplies stolen interest; count underflow permanently bricks repayment, locking borrower collateral.
**Insight:** When auditing lending/credit contracts, check every outbound token transfer to a counterparty for hook-enabled tokens (ERC777, ERC1363, ERC677); a re-entrant close/repay that re-sends the same deposit can both drain interest and underflow share/count accounting, bricking the position.