# BiFi: frozen idle-gap interest overcharge drains USDT market

BiFi USDT market stored a 264,059-block idle gap and charged it as interest on every same-block action at attacker-set utilization, draining ~165,574 USDT.

- Payout: Real-world hack
- Severity: high
- Program: BiFi
- Disclosed: 2026-10-17
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-10/BiFi_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20261017-bifi
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** BiFi USDT market (UsdtHandlerProxy / TokenHandler / interestModel) on Ethereum
**Root cause:** TokenHandler._checkFirstAction stores the full idle block gap (264,059 blocks) as inactiveActionDelta and freezes actionEXR for the block; interestModel.getInterestAmount then multiplies that whole gap by a utilization rate recomputed from live deposit/borrow totals on every call, so each same-block action re-charges ~36 days of interest at an attacker-controlled rate.
**Steps:**
1. Flash-borrow 40,499,999.999997 USDT from Morpho Blue (fee 0)
2. Deposit in five growing tranches (first action freezes rate and stores 264,059-block gap), then `deposit(0)` to settle interest
3. Borrow 1,498,500 USDT twenty times to spike utilization to attacker-chosen rate
4. Loop twenty times: `repay(1,498,500)` then `withdraw(2,025,000)` to pull inflated deposit interest
5. Repay and withdraw the 40.5M principal position
6. Repeat deposit/borrow/repay/withdraw cycle once more, then withdraw residual inflated interest
7. Repay flash loan in full and swap 165,574 USDT surplus to WETH via Uniswap v3 SwapRouter
**How found:** Read verified TokenHandler/interestModel source: noticed _checkFirstAction stores the entire idle blockDelta and only the first action per block updates it, while getInterestAmount multiplies inactiveActionDelta by a live-recomputed SIR — implying repeated same-block actions re-charge the full gap at attacker-set utilization. Confirmed on a fork at parent block 26210254.
**Exploitation:** Permissionless deposit/borrow/repay/withdraw on the idle USDT market; flash loan supplies capital, deposit seeds the frozen 264,059-block gap, borrows spike utilization so the interest model credits ~36 days of deposit interest per same-block action, and a repay/withdraw loop cashes out the inflated deposit side. Surplus over flash principal (~165,574 USDT) swapped to 68.0572 WETH.
**Escalation:** Two full cycles amplify the overcharge; MEV bot c0ffeebabe front-ran the same permissionless mechanism one block later to capture the profit.
**Insight:** Lazy-accrual interest models that store an idle block gap and recompute rate from live totals are exploitable: any permissionless action that changes utilization within the same block re-applies the whole gap. Look for markets idle for long periods and check whether the stored delta is amortized or clamped per action.