# Comptroller.healAccount doesn't distribute rewards for a healed borrower

Comptroller.healAccount seizes collateral and clears debt via healBorrow, which skips reward accrual, so the healed borrower loses earned borrow rewards.

- Payout: Contest reward
- Severity: medium
- Program: Venus Protocol
- Credited: rvierdiiev
- Disclosed: 2023-08-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-venus-findings/issues/116
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** Comptroller/VToken lending contracts (Solidity)
**Root cause:** healAccount calls market.healBorrow to zero the debt, but healBorrow never invokes any Comptroller hook, so accrued borrow rewards are never distributed before the debt is cleared.
**Steps:**
1. Call `Comptroller.healAccount(user)` repaying a percentage of the user's borrow.
2. Loop calls `market.seize(liquidator, user, tokens)` which triggers `comptroller.preSeizeHook` distributing only supply rewards.
3. Loop calls `market.healBorrow(liquidator, user, repaymentAmount)` which sets borrow balance to 0 without calling any Comptroller reward hook.
4. Borrow rewards accrued before healing are never distributed to the user.
**How found:** Code reading of healAccount's seize/healBorrow loop, noticing preSeizeHook distributes supply rewards but healBorrow has no Comptroller callback, so borrow-side rewards are skipped.
**Exploitation:** Anyone can call healAccount on an underwater account; the borrower's accumulated borrow rewards are silently forfeited when healBorrow zeroes the debt without a reward-accrual hook.
**Insight:** When auditing reward-accrual systems, check every path that mutates a user's balance (heal, forgive, seize, liquidate) for a missing accrue/distribute hook — reward loss hides in state-zeroing functions that bypass the normal update path.