# It's possible to borrow, redeem, transfer tokens and exit markets with outdated collateral prices and borrow interest

Comptroller liquidity checks use stale oracle prices and unaccrued borrow interest for all markets except the one being acted on, enabling over-borrowing against stale collateral.

- Payout: Contest reward
- Severity: medium
- Program: Venus Protocol
- Credited: 0x73696d616f
- Disclosed: 2023-08-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-venus-findings/issues/486
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** Comptroller._getHypotheticalLiquiditySnapshot / VToken markets
**Root cause:** The liquidity snapshot loop reads oracle prices and borrow balances for every asset without calling oracle.updatePrice or accrueInterest on the secondary markets, so only the VToken triggering the hook has fresh price/interest.
**Steps:**
1. Account holds collateral in market A and debt/position in market B.
2. Price of A drops but A's oracle is not updated (no direct interaction with A).
3. User calls borrow/redeem/transfer on market B, which updates only B's price and interest.
4. Comptroller._getHypotheticalLiquiditySnapshot uses stale price for A and stale borrowBalance for other markets.
5. Liquidity check passes with inflated collateral value, allowing excess borrow/redeem/transfer or market exit.
**How found:** Code reading of _getHypotheticalLiquiditySnapshot loop: noticed oracle.updatePrice and accrueInterest are only invoked for the vTokenModify asset, not for other assets iterated in the snapshot.
**Exploitation:** Attacker waits for a collateral asset to fall in price without a direct Venus interaction refreshing its TWAP, then borrows/redeems against the stale higher valuation in another market, extracting more than entitled.
**Insight:** In lending protocols, check whether every market touched by a health/liquidity computation refreshes its price and interest, not just the market the user directly calls; secondary markets in the loop are the stale ones.