#  Users can lend and borrow above allowed limitations

Revert Lend's daily lend/borrow increase limit computed as 110% of assets instead of 10% due to extra Q32 term, letting users exceed intended caps.

- Payout: Contest reward
- Severity: medium
- Program: Revert Lend
- Credited: JohnSmith
- Disclosed: 2024-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-revert-lend-findings/issues/415
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-06
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** V3Vault.sol daily lend/debt increase limit calculation
**Root cause:** The limit formula multiplies by (Q32 + MAX_DAILY_*_INCREASE_X32) / Q32, adding 1.0 to the intended fraction, so the cap becomes 110% of assets instead of 10%.
**Steps:**
1. Deploy V3Vault with USDC; call `vault.setLimits(0, 150000_000000, 0, 10_000000, 0)` to set dailyLendIncreaseLimitMin=10 USDC.
2. As WHALE_ACCOUNT, `USDC.approve(vault, max)` and `vault.deposit(10_000000, WHALE_ACCOUNT)`.
3. `skip(1 days)`; loop 10 times: read `assets = vault.totalAssets()`, compute `amount = assets + assets*9/100`, call `vault.deposit(amount, WHALE_ACCOUNT)`, `skip(1 days)`.
4. Observe total assets ~15902 USDC after 10 days despite 10 USDC/day limit.
5. For borrow: `vault.setLimits(0, 150_000000, 150_000000, 150_000000, 1_000000)`, `skip(1 days)`, call `_setupBasicLoan(true)` to borrow 8847 USDC > 1 USDC min and >10% of vault assets.
**How found:** Code review of `_resetDailyLendIncreaseLimit` and `_resetDailyDebtIncreaseLimit` spotted the `(Q32 + MAX_DAILY_*_INCREASE_X32)` term, which adds 1.0 to the fraction, inflating the limit from 10% to 110%.
**Exploitation:** Attacker repeatedly deposits or borrows up to ~109% of current vault assets each day, bypassing the intended 10% daily cap, enabling rapid scaling of position beyond protocol risk limits.
**Insight:** When a fraction is expressed in Q32 fixed-point, check whether the constant is added to Q32 (1.0) or used alone; an extra Q32 silently turns a 10% cap into 110%.