# Wrong calculation of repayment amount in Position contract

Position._repay prices a user's whole borrow at the current borrowRatePerBlock, so later borrowers inflate the rate and cause over-repayment.

- Payout: Contest reward
- Severity: high
- Program: Rubicon
- Credited: Toshii
- Disclosed: 2025-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-rubicon-findings/issues/1003
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Position.sol leveraged position / repay logic
**Root cause:** Interest is computed as current borrowRatePerBlock() times blocks elapsed, but borrowRatePerBlock is a function of total borrows/supply and changes over the borrow duration, so it does not reflect the rate actually accrued.
**Steps:**
1. Bob opens a leveraged position via `buyAllAmountWithLeverage(..)`, raising the cToken borrow rate.
2. Alice opens another leveraged position, raising the borrow rate further.
3. Bob calls `closePosition(..)` -> `_repay(..)`, which calls `borrowBalanceOfPos(..)` using the now-elevated `borrowRatePerBlock()`.
4. Repayment amount is overstated; excess `asset` is swapped to `quote` beyond what repayment needs.
**How found:** Code reading of _repay/borrowBalanceOfPos: noticed interest uses a single current borrowRatePerBlock() multiplied by elapsed blocks, and reasoned that this rate is dynamic (function of total borrows/supply), so it cannot represent the whole borrow period.
**Exploitation:** A borrower waits until other users increase total borrows (raising borrowRatePerBlock), then closes their position; _repay computes interest at the inflated current rate, swapping more asset to quote than required for repayment.
**Insight:** When a contract prices accrued interest using a live, state-dependent rate (e.g. cToken borrowRatePerBlock) times elapsed time, check whether the rate is assumed constant; other users' actions can shift it and skew repay amounts.