# The calculation of ````totalUSDborrowed```` in ````openLoan()```` is not correct

openLoan() computed totalUSDborrowed from isoUSDLoaned (principal only) instead of isoUSDLoanAndInterest, letting attacker borrow isoUSD with insufficient collateral.

- Payout: Contest reward
- Severity: high
- Program: Isomorph
- Credited: Jeiwan
- Disclosed: 2022-11-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-11-isomorph-judging/issues/85
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Vault_Synths.sol openLoan() collateral margin check
**Root cause:** openLoan() uses isoUSDLoaned (principal) rather than isoUSDLoanAndInterest (principal+interest) when computing totalUSDborrowed, so accrued interest is excluded from the margin requirement.
**Steps:**
1. Open a loan and accrue ~10000 isoUSD of interest on it.
2. Repay the principal but leave the interest outstanding.
3. Call `openLoan()` for a new 10000 isoUSD loan; totalUSDborrowed only counts isoUSDLoaned (0), so the `colInUSD >= borrowMargin` check passes with no collateral.
**How found:** Code review of openLoan() margin math; noticed totalUSDborrowed used isoUSDLoaned instead of isoUSDLoanAndInterest, meaning interest is excluded from collateral check.
**Exploitation:** Attacker builds up unpaid interest on an existing position, repays principal, then opens a fresh loan sized to the ignored interest amount; the margin check sees only principal and approves borrowing without adequate collateral.
**Insight:** In lending contracts, audit every place principal and interest are tracked separately: any margin/health check that reads the principal-only mapping instead of the combined debt mapping lets accrued interest escape collateralization.