# Calculation for lender withdrawals in _applyWithdrawalBatchPayment() should not round up

Rounding up in normalizeAmount during withdrawal batch payment inflates totalDebts, making a fully-funded Wildcat market incorrectly delinquent and charging borrowers extra fees.

- Payout: Contest reward
- Severity: medium
- Program: Wildcat Protocol
- Credited: MiloTruck
- Disclosed: 2023-12-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-wildcat-findings/issues/501
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** WildcatMarketBase._applyWithdrawalBatchPayment / MarketState.normalizeAmount (Solidity market contract)
**Root cause:** normalizeAmount() rounds up when converting scaled tokens to assets, so normalizedAmountPaid can exceed the true owed amount by 1, inflating totalDebts above the market's asset balance.
**Steps:**
1. Lender deposits and borrower borrows all assets; skip 1 day + 1s to accrue interest.
2. Borrower transfers `totalDebts() - totalAssets()` so market is exactly funded; call `collectFees()`.
3. Lender calls `queueWithdrawal(710992167266111033190)` then `queueWithdrawal(balanceOf(lender))` in two batches.
4. Observe `currentState().isDelinquent == true` despite same total withdrawn as a single batch which stays non-delinquent.
5. Repeat after `closeMarket()` to show market becomes delinquent post-closure.
**How found:** Code review of the scaled-to-normalized conversion in _applyWithdrawalBatchPayment, noticing normalizeAmount rounds up and reasoning that totalDebts could exceed assets by 1 wei, then constructing a Foundry PoC comparing single vs split withdrawals.
**Escalation:** Splitting a withdrawal into multiple batches to trigger the rounding-up path; also demonstrated post-closeMarket delinquency.
**Insight:** When a protocol enforces an invariant like 'assets >= totalDebts means never delinquent', audit every rounding direction in conversions that feed totalDebts; a 1-wei upward rounding in a payment path can flip a state flag (delinquency) and change interest rates.