# Loss of funds for users as the manual VIC forgets about interest before the deadline

Morpho vault's manual VIC returns zero interest per second after deadline, discarding unaccrued interest so a redeeming depositor loses earned yield.

- Payout: Contest reward
- Severity: medium
- Program: Morpho
- Credited: samuraii77
- Disclosed: 2025-11-05
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_morpho_jul2025.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Amorpho_jul2025%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity vuln:business-logic vuln:reward-distribution

**Target:** Vault interest accrual / manual VIC contract
**Root cause:** The manual VIC's interestPerSecond returns storedInterestPerSecond only while block.timestamp <= deadline and 0 afterward, so interest accrued during the active window but not yet realized is lost once the deadline passes.
**Steps:**
1. Deploy vault with manual VIC; Bob deposits 1000 assets as sole depositor.
2. Admin sets deadline = now+10s with storedInterestPerSecond=10 (100 interest owed).
3. Wait 10s so 100 interest accrues, then wait 20s more without any vault interaction.
4. Bob redeems all shares; VIC now returns 0 because block.timestamp > deadline.
5. Bob receives 1000 assets instead of 1100; 100 interest is lost.
**How found:** Code review of the manual VIC's interestPerSecond: noticed it returns 0 past deadline without accounting for interest accrued during the active window.
**Exploitation:** Any depositor redeeming after the VIC deadline receives principal without accrued interest; the unaccrued interest is silently dropped rather than distributed.
**Insight:** When a rate oracle gates on a deadline, check whether interest accrued before expiry is checkpointed; a view function returning 0 post-deadline silently discards unaccrued yield.