# collectFees() updates delinquency wrongly as _writeState() is called before assets are transferred 

collectFees() writes state before transferring fees, so totalAssets() is overstated and a delinquent market is wrongly marked non-delinquent, letting borrower dodge penalty fees.

- Payout: Contest reward
- Severity: medium
- Program: Wildcat Protocol
- Credited: MiloTruck
- Disclosed: 2023-12-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-wildcat-findings/issues/500
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** WildcatMarket.collectFees / _writeState delinquency check
**Root cause:** _writeState() reads totalAssets() via balanceOf before the fee transfer out, so liquidityRequired is compared against an inflated balance, clearing isDelinquent incorrectly.
**Steps:**
1. Deploy market with protocol fee 10%, lender deposits 1000e18.
2. Skip 2 weeks, call updateState(); market is delinquent.
3. Borrower tops up exactly coverageLiquidity() - totalAssets() - accruedProtocolFees().
4. Call collectFees(); _writeState() sees liquidityRequired == totalAssets() and sets isDelinquent=false.
5. After transfer, totalAssets() < coverageLiquidity() but state remains non-delinquent.
**How found:** Code reading of collectFees() ordering: noticed _writeState() precedes asset.safeTransfer(), and _writeState() depends on totalAssets() = balanceOf, so the balance is stale at check time.
**Exploitation:** Borrower tops up just enough to make liquidityRequired equal the pre-transfer balance, calls collectFees(), and the market is marked non-delinquent despite being short after the fee leaves; delinquency fee is not applied to scaleFactor until a later state update.
**Insight:** When a state-writing function reads live token balances, check whether any transfer in the same function happens after the write; ordering bugs in balance-derived flags (delinquency, solvency) are easy to miss and cheap to test with a top-up to the exact boundary.