# DnGmxJuniorVaultManager#harvestFees can push junior vault borrowedUSDC above borrow cap and DOS vault

harvestFees deposits senior vault USDC fees into Aave, raising junior vault's getUsdcBorrowed above its borrow cap and underflowing availableBorrow, blocking deposits/withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: Rage Trade
- Credited: 0x52
- Disclosed: 2022-10-28
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-rage-trade-judging/issues/67
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-rage-trade%3AM-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** DnGmxJuniorVaultManager / DnGmxSeniorVault (Solidity vault contracts)
**Root cause:** harvestFees supplies converted WETH fees as aUSDC to the junior vault, which getUsdcBorrowed counts as borrowed USDC; if already at cap, borrowCaps[borrower] - getUsdcBorrowed() underflows in availableBorrow.
**Steps:**
1. Junior vault reaches its borrow cap (getUsdcBorrowed == borrowCaps[junior]).
2. harvestFees runs when seniorVaultWethRewards > wethConversionThreshold: swaps WETH to USDC and `_executeSupply(usdc, aaveUsdcAmount)`, increasing aUsdc.balanceOf(junior).
3. getUsdcBorrowed() = aUsdc.balanceOf(this) - dnUsdcDeposited - unhedgedGlpInUsdc now exceeds borrowCaps[junior].
4. Any deposit/withdraw calls availableBorrow, where `borrowCaps[borrower] - getUsdcBorrowed()` underflows and reverts.
**How found:** Code reading of harvestFees accounting: noticed fees are credited by increasing junior vault debt via aUSDC supply, then traced getUsdcBorrowed and availableBorrow subtraction to spot the underflow when at cap.
**Exploitation:** Not an attacker-driven exploit; the fee-harvest path itself pushes borrowed above cap, permanently reverting availableBorrow and thus junior vault deposit/withdraw flows (griefing/DOS by normal operation).
**Insight:** When a protocol credits yield by inflating a position's balance rather than a separate accounting variable, check every cap/limit subtraction that derives from that balance for underflow at the boundary.