# Due to interest rates update method, Interest-Free Loans are possible and the costs of DoS are reduced

Revert Lend updates interest once per block, so borrowing and repaying within one block incurs zero interest, enabling free flash-loan-style capital and cheap daily-limit DoS.

- Payout: Contest reward
- Severity: medium
- Program: Revert Lend
- Credited: alix40
- Disclosed: 2024-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-revert-lend-findings/issues/435
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-04
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** V3Vault lending contract (borrow/repay, interest accrual)
**Root cause:** _updateGlobalInterest only recalculates exchange rates when block.timestamp > lastExchangeRateUpdate, so all borrow/repay within the same block (or same timestamp on L2s) use stale rates and accrue no interest.
**Steps:**
1. Deposit USDC into vault as lender (`vault.deposit(1000000, ...)`)
2. Create a position with an NFT collateral (`vault.create(TEST_NFT, owner)`)
3. In the same block call `vault.borrow(TEST_NFT, 100000)`
4. Immediately call `vault.repay(TEST_NFT, 100000, false)` in the same block
5. Observe balance returns to 0 with no interest charged; repeat each block to consume the daily borrow limit
**How found:** Code reading of `_updateGlobalInterest` revealed the once-per-block update guard; author hypothesized same-block borrow/repay avoids interest and wrote a Foundry test to confirm zero-cost debt, then modeled gas cost of sustained DoS.
**Exploitation:** Attacker with a large LP collateral position borrows up to the daily limit (10% of deposits) at block start (frontrun) and repays at block end (backrun), paying zero interest while blocking other borrowers; repeated every block for 24h at ~$2300-4000 gas cost on Arbitrum.
**Escalation:** Repeat across consecutive blocks (or L2 blocks sharing a timestamp) to sustain DoS and deny interest to LPs; MEV bots can hold debt across blocks borrowing in first tx and repaying in last tx.
**Insight:** When interest/exchange rates are cached per block.timestamp, check whether borrow+repay inside one block (or multiple L2 blocks sharing a timestamp) skips accrual entirely; also check whether daily borrow limits reset on repay enabling limit exhaustion.