# The BigBang contract take more fees than it should

BigBang _repay burns only the borrow part instead of the original debt, so the protocol retains excess fees from every borrower after the first.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: 0xRobocop
- Disclosed: 2023-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/87
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-59
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** BigBang lending market repay() / _repay()
**Root cause:** _repay computes toBurn = amount - (amount - part) = part, treating the elastic debt part as the original principal; once fees accrue, part < originalDebt, so the burned amount is too small and the leftover stays as protocol fees.
**Steps:**
1. Set bigBangEthDebtRate = 1e17 (10%/yr) and borrowOpeningFee = 0.
2. Borrower A borrows 1000 USDO; part[A]=1000, total.part=1000, total.elastic=1000.
3. Time-travel 365 days; total.elastic=1100.
4. Borrower B borrows 1000 USDO; part[B]=1000*1000/1100=909.09, total.part=1909.09, total.elastic=2100.
5. Time-travel another 365 days; total.elastic=2310.
6. B repays full part via `repay(eoa1, eoa1, false, eoa1BorrowPart)`; contract withdraws 1100 but burns only 909.09, retaining 190.91 instead of the 100 owed.
**How found:** Code review of _repay: noticed toBurn simplifies to `part`, then reasoned that part only equals original debt for the first borrower because elastic/base diverge once interest accrues; validated with a two-borrower Hardhat scenario over two years.
**Exploitation:** Any borrower repaying after fees have accrued overpays: the contract withdraws the full elastic amount from YieldBox but burns only the base part, leaving the difference as protocol balance that Penrose later collects. Repeated across all non-first borrowers, systematically overcharges fees.
**Insight:** In elastic/base debt models, always check whether fee/burn math uses `part` (base) where it should use the original principal or `amount - accrued`; the first borrower masks the bug because part==debt only at 1:1 ratio.