# Loans can be rolled an unlimited number of times

Cooler loan roll() has no cap on roll count, letting a borrower extend the loan term indefinitely while the lender cannot stop it.

- Payout: Contest reward
- Severity: high
- Program: Cooler
- Credited: 0x52
- Disclosed: 2023-01-16
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-cooler-judging/issues/215
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-cooler%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Cooler lending contract roll() function
**Root cause:** roll() only checks loan.rollable boolean and expiry, with no limit on number of rolls or per-term gating, so a borrower can repeatedly extend expiry and accrue debt in one or many transactions.
**Steps:**
1. Lender calls clear() to fund loan; loan.rollable defaults to true
2. Borrower calls `roll(loanID)` repeatedly (same tx or quick succession)
3. Each call adds req.duration to loan.expiry and interest to loan.amount, transferring newCollateral
4. Lender cannot toggleRoll() in time if rolls happen in a single transaction
**How found:** Code review of roll() noting only a boolean rollable gate and no count/timestamp restriction, plus default-true initialization of loan.rollable.
**Exploitation:** Borrower pays interest up front and calls roll() many times to push expiry arbitrarily far, forcing lender to wait indefinitely or accept depreciated collateral on default.
**Insight:** When a boolean toggle gates a state-changing action, check whether the action can be repeated atomically before the toggle can be flipped; look for missing per-action counters or time-window constraints.