# _badDebtMapping[collateral] can be unintentionally rewrite

In Term Structure's redeemFromMarket, bad debt for a collateral is overwritten with `=` instead of `+=`, understating debt and shortchanging users in dealBadDebt.

- Payout: Contest reward
- Severity: high
- Program: Term Structure
- Credited: BengalCatBalu
- Disclosed: 2025-03-20
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_term_structure_february2025.pdf#3.1.4
- Library page: https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.1.4
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** redeemFromMarket / dealBadDebt in Term Structure market contract
**Root cause:** _badDebtMapping[collateral] is assigned (`=`) rather than accumulated (`+=`) when totalRedeem < ftReserve, so a later redemption for a market sharing the same collateral overwrites prior bad debt.
**Steps:**
1. Create/redeem orders across two markets sharing the same collateral but different debtToken.
2. Trigger redeemFromMarket where totalRedeem < ftReserve (withdrawal fee makes this common) for order A: `_badDebtMapping[collateral] = ftReserveA - totalRedeemA`.
3. Redeem order B on the other market with same collateral: value is overwritten with B's smaller bad debt.
4. Call `dealBadDebt(recipient, collateral, amount)`; payout = `amount * collateralBalance / badDebtAmt` uses the understated badDebtAmt, mispricing redemptions.
**How found:** Code reading of redeemFromMarket noticed `=` assignment to _badDebtMapping; reasoned that multiple markets can share a collateral, so repeated redemptions overwrite the stored value, then traced impact through dealBadDebt's proportional payout math.
**Exploitation:** Attacker or any redeemer benefits because dealBadDebt computes collateralOut proportional to collateralBalance/badDebtAmt; overwriting lowers badDebtAmt, inflating per-unit payout and draining collateral faster, leaving other bad-debt holders undercompensated.
**Insight:** When auditing accounting mappings keyed by a shared identifier (collateral, token, user), check whether markets/orders with different debt tokens can collide on that key and whether writes accumulate or overwrite; then trace the overwritten value into payout formulas where a smaller denominator inflates per-unit withdrawals.