# Collateral can be locked in BigBang contract when debtStartPoint is nonzero

In Tapioca BigBang non-ETH markets, borrowing less than debtStartPoint makes getDebtRate underflow and revert, permanently locking the borrower's collateral.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: zzzitron
- Disclosed: 2023-11-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1046
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-31
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** BigBang lending market contract (Solidity)
**Root cause:** getDebtRate computes (_currentDebt - debtStartPoint) without checking _currentDebt >= debtStartPoint; when totalBorrow.elastic is nonzero but below debtStartPoint, the subtraction underflows and reverts.
**Steps:**
1. Deploy non-ETH BigBang market via Penrose.registerBigBang with data.debtStartPoint = 1e18 (nonzero).
2. Ensure ETH market has some borrowed debt so bigBangEthMarket().getTotalDebt() > 0.
3. User adds collateral and calls BigBang.borrow() with amount < debtStartPoint.
4. totalBorrow.elastic becomes nonzero but < debtStartPoint; getDebtRate() reverts at `(_currentDebt - debtStartPoint)`.
5. _accrue() reverts, so repay() and liquidate() also revert, trapping collateral.
**How found:** Code reading of getDebtRate's arithmetic: noticed the subtraction of debtStartPoint from _currentDebt lacks a lower-bound check, and traced that _accrue (called by repay/liquidate) invokes getDebtRate, so a revert bricks all debt-touching functions.
**Insight:** When a config parameter (debtStartPoint) is subtracted from a live state variable, check whether state can legitimately fall below it — especially when that view function is called inside _accrue, which gates repay/liquidate and can permanently lock funds.