# `originationFee` may result in the borrower account becoming liquidatable immediately

Sentiment's borrow check ignored originationFee, so a large fee could leave a borrower instantly liquidatable after borrowing.

- Payout: Contest reward
- Severity: medium
- Program: Sentiment
- Credited: WATCHPUG
- Disclosed: 2022-08-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-08-sentiment-judging/tree/main/501-M
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-16
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:fee-bypass vuln:liquidation

**Target:** Lending protocol borrow flow / RiskEngine.isBorrowAllowed
**Root cause:** isBorrowAllowed computes health using the full borrow amount but not the originationFee deducted from the received amount, so post-borrow account value is overstated.
**Steps:**
1. Set USDC originationFee to 30% via updateOriginationFee
2. Alice with 100 USDC and 0 debt calls borrow(account, USDC, 400)
3. isBorrowAllowed passes since it checks 400 borrow vs 400 value
4. Alice receives only 280 USDC after fee; account now unhealthy/liquidatable
**How found:** Code review of the newly added fee-accrual PR: noticed borrow() calls isBorrowAllowed before lendTo, and that the fee is applied in lendTo but never reflected in the risk check.
**Insight:** When a fee is deducted inside the token's lendTo after the risk check, the health check sees gross borrow value while the account only receives net—audit any post-check value mutation in lending flows.