# Borrowers can escape from paying half of the penalty fees by closing the market, and those remaining penalty fees will be covered by the lender who withdraws last

Wildcat closeMarket settles debt using current scaleFactor without accounting for remaining timeDelinquent penalty accrual, so the last withdrawing lender absorbs unpaid penalties.

- Payout: Contest reward
- Severity: high
- Program: Wildcat Protocol
- Credited: osmanozdemir1
- Disclosed: 2023-12-11
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-10-wildcat-findings/issues/506
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** WildcatMarket.closeMarket / FeeMath penalty accrual
**Root cause:** closeMarket computes totalDebts from the current scaleFactor but ignores state.timeDelinquent, so penalty fees that would still accrue during the grace-tracker countdown are never charged to the borrower.
**Steps:**
1. Deposit from two lenders, borrower borrows 80%, queue and execute withdrawals to drive reserves to 0 and make market delinquent.
2. skip(30 days) while delinquent so penalty accrues.
3. Mint/approve borrower funds and call `market.closeMarket()`; totalDebts is settled at current scaleFactor and market closes.
4. skip(30 days); `market.updateState()` shows totalDebts and scaleFactor increased despite annualInterestBips=0.
5. Alice queues and executes full withdrawal; remaining totalAssets < Bob's normalized balance, so Bob (last lender) eats the shortfall.
**How found:** Reading closeMarket alongside FeeMath penalty logic: noticed totalDebts uses current scaleFactor and never checks state.timeDelinquent, so post-close penalty accrual is unaccounted.
**Exploitation:** Borrower waits until delinquent, then closes the market paying only debt at the current scaleFactor; remaining penalty accrual continues post-close and is socialized onto the last lender to withdraw.
**Insight:** When a settlement/close path snapshots debt via a compounding scaleFactor, check whether any time-based accrual (delinquency countdown, grace tracker) is still pending and thus excluded from the snapshot.