# Fail to accrue interests on multiple token positions

BlueBerryBank pokes interest accrual only for the acted-on token, so multi-token positions under-report debt and evade liquidation checks.

- Payout: Contest reward
- Severity: high
- Program: Blueberry
- Credited: cducrest-brainbot
- Disclosed: 2023-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-blueberry-judging/issues/140
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:liquidation

**Target:** BlueBerryBank.sol lending/borrow position accounting
**Root cause:** borrow/repay/lend/withdrawLend call poke(token) only for the concerned token, leaving other debt tokens' bank.totalDebt stale; isLiquidatable then sums under-accrued debt.
**Steps:**
1. Open a position with debt in two tokens A and B.
2. Let interest accrue on both so the position is actually liquidatable.
3. Call `borrow`/`repay`/`lend`/`withdrawLend` on token A only, which pokes A but not B.
4. execute() runs isLiquidatable() using stale totalDebt for B, so the position appears healthy and the tx does not revert.
**How found:** Code reading of execute()'s liquidation check versus per-action poke(token) calls; noticed totalDebt loop covers all tokens but accrual only touches one.
**Exploitation:** Attacker with a multi-token debt position performs actions on one token to keep the position nominally healthy despite accrued interest on other tokens, avoiding liquidation and worsening bank debt.
**Insight:** When a health check sums per-token debt, verify every token's interest is accrued before the check, not just the token the action touches.