# Mismatch between the SAFE generated debt and the amount of the system tokens minted for the user

Open Dollar's generateDebt mints _deltaWad COIN to user but records a different adjusted debt in the SAFE, causing mismatch and possible revert.

- Payout: Contest reward
- Severity: medium
- Program: Open Dollar
- Credited: hals
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-opendollar-findings/issues/371
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-opendollar%3AM-04
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:precision-loss

**Target:** BasicActions proxy contract (generateDebt)
**Root cause:** _getGeneratedDeltaDebt adjusts the debt based on existing SAFE coin balance and accumulated rate, but _collectAndExitCoins still mints the original _deltaWad, so recorded debt and minted coins diverge.
**Steps:**
1. Call BasicActions.generateDebt with _deltaWad larger than collateral allows
2. _getGeneratedDeltaDebt computes a smaller _deltaDebt using coinBalance and accumulatedRate
3. _modifySAFECollateralization records the smaller debt
4. _collectAndExitCoins mints the original _deltaWad COIN to the EOA
5. Mismatch: minted coins exceed recorded debt, or exit reverts if _deltaWad exceeds available collateral
**How found:** Code reading of generateDebt noticed the debt value passed to _modifySAFECollateralization is transformed by _getGeneratedDeltaDebt while the exit amount uses the raw _deltaWad.
**Exploitation:** Not weaponized; the mismatch causes incorrect debt accounting and potential revert when _deltaWad exceeds collateral, breaking intended generateDebt flow.
**Insight:** When a helper function silently adjusts an amount (rate/balance normalization), verify every downstream use of the original vs adjusted value; mismatches between recorded state and transferred value are a recurring accounting bug.