# Exploiting the exclusion of principal fee from old principal when reroll is called

Rollover path omits lender principal fee deduction, letting borrower and lender collude to pocket fees owed to the protocol.

- Payout: Contest reward
- Severity: medium
- Program: Arcade
- Credited: Lanrebayode77
- Disclosed: 2024-04-08
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_arcade_mar2024.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Aarcade_mar2024%3A3.1.2
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:fee-bypass

**Target:** RepaymentController / OriginationCalculator rollover logic
**Root cause:** _calculateRolloverAmounts computes only interestFee and never deducts lenderPrincipalFee from the amount sent to the old lender, unlike _prepareRepay which subtracts both.
**Steps:**
1. Lender signs a large loan term with lenderPrincipalFee set (e.g. 1% of principal).
2. Borrower calls reroll/rolloverLoan with a tiny new principal and the same lender's signature.
3. Observe rolloverAmounts: amountFromLender only adds interestFee, not principalFee.
4. amountToLender = repayAmount - amountFromLender, so old lender receives principalFee that should have gone to protocol.
5. Borrower immediately calls repayFull in same block to close new loan.
**How found:** Code review comparing _prepareRepay (deducts interestFee and principalFee) against _calculateRolloverAmounts (deducts only interestFee), spotting the missing principalFee deduction annotated with '@audit What about Principal fee???'.
**Exploitation:** Borrower and lender collude: lender signs a rollover with a small new principal; rollover settles old loan without deducting principalFee, so lender receives the fee; borrower repays new loan immediately. Profit equals principalFee on the large old loan.
**Escalation:** Repeat across many large loans to accumulate protocol fee loss ($100k-$1M annually per author).
**Insight:** When a protocol has parallel settlement paths (direct repay vs rollover), diff the fee/accounting math line-by-line between them; any fee deducted in one path but not the other is a leak, especially where the same lender can be reused.