# Delisted assets can still be deposited and borrowed against by accounts that already have them

Delisted assets could still be used as collateral by accounts already holding them, bypassing deposit restrictions via direct token transfer.

- Payout: Contest reward
- Severity: medium
- Program: Sentiment
- Credited: 0x52
- Disclosed: 2022-08-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-08-sentiment-judging/tree/main/154-M
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** AccountManager.sol deposit / account health calculation
**Root cause:** Deposit restriction only checks the deposit() entrypoint, but account health sums the account contract's full token balance, so tokens sent directly to the account contract count as collateral without passing the allowlist check.
**Steps:**
1. Account already holds delisted asset X on its asset list
2. Call to AccountManager.deposit(X) is blocked by allowlist check
3. Instead transfer X tokens directly to the account contract address
4. Account health calculation reads total balance of account address, counting X as collateral
5. Borrow against the delisted asset
**How found:** Noticed deposit() enforces the supported-collateral list but health calculation uses raw account balance, so direct transfers bypass the check.
**Exploitation:** Existing holders of a delisted asset transfer more tokens directly to their account contract, sidestepping the deposit allowlist, and continue borrowing against the delisted collateral.
**Insight:** When an allowlist is enforced at a deposit function, check whether downstream accounting reads raw token balances instead of tracked deposits; direct transfers then bypass the restriction.