# Loan can be written off by anybody before overdue delay expires

Stale lastRepay after debtWriteOff lets any member instantly write off a borrower's new loan, causing staker funds loss.

- Payout: Contest reward
- Severity: high
- Program: Union Finance
- Credited: Bahurum
- Disclosed: 2022-11-04
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-union-finance-judging/issues/115
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-union-finance%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** UToken/UserManager lending contracts
**Root cause:** UToken.debtWriteOff zeroes principal but never resets accountBorrows[borrower].lastRepay, so a subsequent borrow keeps the old timestamp and passes the overdue check.
**Steps:**
1. Staker vouches borrower; borrower calls `UToken.borrow`, setting `lastRepay` to current block.
2. Staker calls `UserManager.debtWriteOff`; principal set to 0 but `lastRepay` unchanged.
3. Wait 90 days; new staker vouches for same borrower.
4. Borrower calls `UToken.borrow` again; `lastRepay` stays stale (non-zero).
5. Any member calls `UserManager.debtWriteOff`; check `block.number <= lastRepay + overdueBlocks + maxOverdueBlocks` fails so no AuthFailed, write-off succeeds immediately.
**How found:** Code reading of debtWriteOff noting principal reset but missing lastRepay update, then tracing borrow's conditional lastRepay update and the overdue check in UserManager.debtWriteOff.
**Exploitation:** Borrower repeatedly obtains loans from trusting stakers and any member (or colluding borrower) instantly writes them off, slashing the staker's stake before the overdue delay.
**Escalation:** Repeatable indefinitely as long as new stakers vouch for the borrower.
**Insight:** When a state-reset function zeroes a debt, audit every related timestamp/counter field for reset too; stale timestamps can bypass time-based authorization gates on subsequent borrows.