# Incorrect interest calculation in SingleMorphoVaultV1Vic

SingleMorphoVaultV1Vic double-counts losses when vault balance exceeds idle balance, causing premature loss accounting and mispriced shares for same-block depositors/withdrawers.

- Payout: Contest reward
- Severity: medium
- Program: Morpho
- Credited: Audittens
- Disclosed: 2025-11-05
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_morpho_jul2025.pdf#3.1.3
- Library page: https://bugbountylibrary.com/r/cantina%3Amorpho_jul2025%3A3.1.3
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** SingleMorphoVaultV1Vic.sol interest accrual / VaultV2 accounting
**Root cause:** interestPerSecond derives profit as max(0, realAssets - totalAssets) where realAssets uses current balance and totalAssets uses stale previewRedeem; when balance > idleBalance (donation or forceDeallocate penalty), a loss is partially reported as profit, then realizeLoss records the full loss again.
**Steps:**
1. Trigger forceDeallocate with non-zero penalty (or donate underlying directly) so balance - idleBalance > 0.
2. Cause a loss in Morpho Vault V1 so previewRedeemnow < previewRedeemprev.
3. Call accrueInterest: vic reports min(|loss|, balance - idleBalance) as interest, lowering _totalAssets prematurely.
4. Call realizeLoss: full loss is applied again, double-counting.
5. Observe _totalAssets lower than expected; management fee undercharged, same-block withdrawers lose funds, depositors get excess shares.
**How found:** Code review of interestPerSecond: noticed profit formula uses current balance vs stale previewRedeem, and that balance can exceed idleBalance via donations or forceDeallocate penalties, making a loss appear as profit.
**Exploitation:** Attacker times a deposit or withdrawal in the same block as the double-counted loss accrual to buy shares cheaply or exit at inflated value, extracting value from other vault users.
**Insight:** When a vault mixes a live token balance with a stale adapter previewRedeem, any path that raises balance without raising idleBalance (donations, penalty transfers) can flip a loss into reported profit; audit accounting formulas for asymmetric sources of balance drift.