# Dust amounts can cause payments to fail, leading to default

Sending dust debt tokens to Cooler before repayment makes loan.amount subtraction underflow, reverting repayment and forcing borrower default.

- Payout: Contest reward
- Severity: medium
- Program: Cooler
- Credited: kiki_dev
- Disclosed: 2023-01-16
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-cooler-judging/issues/218
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-cooler%3AM-4
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Cooler.sol repay() lending contract
**Root cause:** repay() subtracts the full repaid amount from loan.amount without capping at remaining balance; if repaid exceeds loan.amount the subtraction underflows and reverts.
**Steps:**
1. Borrower has an active loan nearing expiry with remaining loan.amount.
2. Attacker transfers a dust amount of debt token to the Cooler contract (or otherwise inflates balance) just before expiry.
3. Borrower's repay(loanID, loan.amount) call now has repaid > loan.amount, so `loan.amount -= repaid` underflows and reverts.
4. Repayment fails before expiry; loan defaults and borrower loses collateral.
**How found:** Code reading of repay(): noticed the else branch subtracts repaid from loan.amount with no min() cap, so any excess balance causes underflow revert.
**Exploitation:** Front-run the borrower's final repayment transaction in the block before expiry by sending a dust amount of debt token so the exact-balance repayment underflows and reverts; borrower cannot repay in time and defaults, forfeiting collateral.
**Insight:** In lending repay logic, check whether subtraction assumes repaid <= loan.amount; any path letting a third party inflate the contract's token balance can grief exact-balance repayments into reverting at the deadline.