# Interest Accrued is removed from totalActiveDebt when calling openTrove

openTrove caches totalActiveDebt before _accrueActiveInterests, then overwrites the accrued interest, desyncing totalActiveDebt and inflating reward distribution.

- Payout: Contest reward
- Severity: high
- Program: Bima
- Credited: santipu
- Disclosed: 2025-02-05
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_bima_december2024.pdf#3.1.4
- Library page: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.1.4
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** TroveManager.openTrove (Liquity-style CDP)
**Root cause:** openTrove caches totalActiveDebt into totalActiveDebtPre before calling _accrueActiveInterests, then recomputes totalActiveDebt as totalActiveDebtPre + _compositeDebt, discarding the interest accrued by _accrueActiveInterests.
**Steps:**
1. Call `openTrove(...)` on TroveManager after interest has accrued since last update.
2. Observe `totalActiveDebtPre = totalActiveDebt` is cached before `t.activeInterestIndex = _accrueActiveInterests()`.
3. `_accrueActiveInterests()` adds accrued interest to totalActiveDebt.
4. `_newTotalDebt = totalActiveDebtPre + _compositeDebt` uses stale cached value, overwriting the accrual.
5. `totalActiveDebt = _newTotalDebt` stores the desynced value, dropping all accrued interest.
**How found:** Code reading of openTrove: noticed totalActiveDebt was cached into totalActiveDebtPre before _accrueActiveInterests mutated totalActiveDebt, then the cached value was used in the final assignment, silently discarding the accrual.
**Exploitation:** Repeated openTrove calls after interest accrual progressively desync totalActiveDebt below the true sum of trove debts; maxSystemDebt checks undercount, reward distribution overpays early claimants leaving insufficient funds, and final trove closures/redeems underflow.
**Escalation:** Repeated openTrove calls compound the desync, amplifying reward over-distribution and eventually causing underflow on last trove close/redeem.
**Insight:** In CDP/accounting contracts, watch for stale caching of aggregate state variables across calls that mutate the same variable (e.g. _accrue* functions); a cached pre-accrual snapshot used in a later assignment silently reverts accrual.