# Different accumulation of debt will break the sorting of Troves

Claiming redistribution rewards adds pending debt to a Trove's interest-bearing base, so identical Troves diverge in NICR and break SortedTroves ordering.

- Payout: Contest reward
- Severity: medium
- Program: Bima
- Credited: santipu
- Disclosed: 2025-02-05
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_bima_december2024.pdf#3.2.11
- Library page: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.11
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** SortedTroves / TroveManager debt accounting
**Root cause:** Accrued debt is computed as prevDebt*interest + pendingRewards; claiming rewards folds pending redistribution debt into the interest-bearing principal, so claimers' debt grows faster than non-claimers'.
**Steps:**
1. Set interest rate to 400 BPS via sbtcTroveManager.setParameters.
2. Open two identical Troves (2000e18 coll, 2e18 debt) for user1 and user2.
3. Register sbtcTroveManager as a bimaVault receiver to activate rewards.
4. Trigger finalizeLiquidation to distribute debt/coll to both Troves.
5. user1 calls sbtcTroveManager.claimReward(user1).
6. vm.warp 30 days; getEntireDebtAndColl shows debt1 > debt2 with equal collateral.
**How found:** Reasoned about how claimReward folds pending redistribution debt into the interest-bearing principal, then wrote a PoC with two identical Troves and one claim to show debt divergence after interest accrual.
**Exploitation:** Not weaponized; divergence in NICR over time causes newly inserted Troves to be mispositioned in SortedTroves, degrading ordered liquidations and redemptions.
**Escalation:** Repeated claim cycles compound NICR divergence until sorting fails entirely.
**Insight:** When auditing sorted-list invariants (NICR/health-factor ordering), check whether any user action changes the interest-bearing principal — reward claims, redistribution absorption, or fee capitalization can silently desync ordering keys.