# Interest is not accrued before parameters are updated in SavingsVest

SavingsVest.setParams updates protocolSafetyFee/vestingPeriod without accruing interest first, letting a sandwich attack jump lockedProfit and misprice yield.

- Payout: Contest reward
- Severity: medium
- Program: Angle Protocol
- Credited: Jeiwan
- Disclosed: 2023-08-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-06-angle-findings/issues/13
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-angle%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** SavingsVest.sol setParams / accrue
**Root cause:** setParams changes protocolSafetyFee and vestingPeriod without calling accrue first, so pending interest is computed under the new parameters and lockedProfit can jump.
**Steps:**
1. Observe SavingsVest.accrue computes interest using protocolSafetyFee and vestingPeriod.
2. Note setParams updates these params without accruing pending interest.
3. Admin tx setParams increases vestingPeriod -> lockedProfit jumps -> totalAssets() jumps.
4. Sandwich the setParams tx: deposit before, withdraw after to capture the mispriced yield.
**How found:** Code reading of setParams vs accrue: noticed parameter changes take effect on unaccrued interest, and Angle confirmed the lockedProfit jump enables sandwiching.
**Exploitation:** Attacker sandwiches the admin setParams transaction: deposits stablecoins before the parameter change and withdraws after, profiting from the jump in lockedProfit/totalAssets caused by unaccrued interest being recomputed under new vestingPeriod.
**Insight:** When a setter changes rate/period parameters, check whether pending accrual is settled first; unaccrued state recomputed under new params creates a step change that can be sandwiched.