# user can drawDebt that is below dust amount

Ajna's _revertOnMinDebt skips the quoteDust check when a pool has 10+ loans, letting a borrower draw debt below the dust minimum.

- Payout: Contest reward
- Severity: medium
- Program: Ajna
- Credited: koxuan
- Disclosed: 2022-12-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-ajna-judging/issues/70
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-18
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** lending pool drawDebt / _revertOnMinDebt helper
**Root cause:** _revertOnMinDebt uses an if/else: when loansCount >= 10 it only checks borrowerDebt against _minDebtAmount (10% of average pool debt) and never enforces quoteDust_, so a low average pool debt lets new debt fall below dust.
**Steps:**
1. Create a pool and have 10 EOAs each drawDebt at the dust limit, so poolDebt is ~10x dust and _minDebtAmount = 10% of average ≈ dust/10.
2. Call drawDebt as a new borrower with an amount below quoteDust_ but above _minDebtAmount.
3. Observe _revertOnMinDebt takes the loansCount>=10 branch and skips the quoteDust_ check, so the sub-dust loan succeeds.
**How found:** Code reading of _revertOnMinDebt noticed the if/else structure means the quoteDust_ branch is unreachable once loansCount >= 10; reviewer then reasoned about how pool state (many small loans) makes _minDebtAmount smaller than dust.
**Exploitation:** Attacker seeds a pool with 10 dust-limit loans to lower the computed minimum debt, then opens a loan below quoteDust_; no material profit identified, mainly a dust-loan policy bypass.
**Insight:** When a guard uses if/else between two thresholds, check whether the higher-count branch can produce a value below the other branch's floor; seeding many minimum-size positions can drag an average-based minimum below the intended dust floor.