# Overflow risk in Market contract

Market._isSolvent multiplies collateralShare by precision and collateralizationRate before YieldBox.toAmount, overflowing uint256 and reverting borrow/repay/removeCollateral, freezing funds.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: KIntern\_NA
- Disclosed: 2023-11-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1109
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-25
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** Market.sol _isSolvent / _computeMaxBorrowableAmount via YieldBoxRebase._toAmount
**Root cause:** collateralShare is pre-multiplied by (EXCHANGE_RATE_PRECISION/FEE_PRECISION)*collateralizationRate (~0.75e39) before being passed to toAmount, so share*totalAmount overflows uint256 once collateralAmount*totalAmount exceeds ~1.5e38.
**Steps:**
1. Call _isSolvent with collateralShare = collateralAmount*1e8 (default rebase offset).
2. Observe toAmount computes share*totalAmount where share ~= collateralAmount*0.75e39.
3. With 18-decimal collateral and sufficient totalAmount, product exceeds 2^256 and reverts.
4. Any borrow/repay/removeCollateral path calling _isSolvent reverts, freezing funds.
**How found:** Code reading of _isSolvent's toAmount call and tracing into YieldBoxRebase._toAmount; derived the effective multiplier from default constants (1e18/1e5 * 0.75e18) and the 1e8 share offset to bound the overflow threshold.
**Insight:** When a rebase/share conversion is wrapped, check whether callers pre-scale the share argument by precision constants; the internal share*totalAmount multiply can overflow even though the raw share fits, especially with 18-decimal tokens and large totalAmount.