# Users partially repaying through the Morpho hook will have their LTV significantly increased

Superform's MorphoRepayAndWithdrawHook ignores accrued interest when computing partial-repay collateral, letting users withdraw inflated collateral and land near LLTV, risking liquidation.

- Payout: Contest reward
- Severity: high
- Program: Superform
- Credited: samuraii77
- Disclosed: 2025-07-17
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_may2025.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** MorphoRepayAndWithdrawHook smart contract (Morpho integration)
**Root cause:** deriveLoanAmount uses the market's cached totalBorrowAssets, ignoring pending accrued interest, so the repay-to-collateral ratio is computed against an understated debt.
**Steps:**
1. User calls hook with executions[2] = `morpho.repay(marketParams, vars.amount, 0, account, "")` (partial, 0 shares) and executions[4] = `morpho.withdrawCollateral(marketParams, collateralForWithdraw, account, account)`.
2. Hook computes `fullCollateral = deriveCollateralForFullRepayment(id, account)` from position collateral.
3. Hook computes `fullLoanAmount = deriveLoanAmount(id, account)` = `castShares.toAssetsUp(market.totalBorrowAssets, market.totalBorrowShares)` using stale cached borrow assets.
4. Hook sets `collateralForWithdraw = Math.mulDiv(fullCollateral, amount, fullLoanAmount)`, overstating collateral because fullLoanAmount excludes pending interest.
5. Example: totalBorrowAssets=100 with 50 pending interest, shares=100, repay 75 of true 150 debt (50%) but withdraw 0.75X (75%) of collateral.
6. Result: LTV jumps near LLTV (or tx reverts if above), exposing user to liquidation.
**How found:** Code review of the hook's collateral math: noticed deriveLoanAmount reads market.totalBorrowAssets (cached) rather than accruing interest, then traced the ratio calculation to show withdrawable collateral is inflated by pending interest.
**Exploitation:** A borrower using the hook for a partial repay plus collateral withdrawal receives more collateral than their true repayment ratio allows; if the resulting LTV sits at LLTV they can be liquidated shortly after, contrary to their healthy position expectation.
**Insight:** When a hook derives debt from Morpho market totals, check whether interest has been accrued; cached totalBorrowAssets understates debt and skews any repay-to-collateral ratio.