# A borrower might drain the vault by calling borrow() repeatedly with small borrow amount each time.

BlueberryBank.borrow() rounds debt shares down to zero for small amounts, letting a borrower repeatedly borrow tokens for free and drain the vault.

- Payout: Contest reward
- Severity: medium
- Program: Blueberry
- Credited: chaduke
- Disclosed: 2023-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-blueberry-judging/issues/45
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AM-14
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** BlueBerryBank.sol borrow() lending vault
**Root cause:** borrow() computes share = amount*totalShare/totalDebt without checking for zero, so small borrow amounts round to zero debt shares while tokens are still transferred out.
**Steps:**
1. Set up state where totalDebt=1,000,000 and totalShare=100,000 (1 share = 10 debt).
2. Call `borrow(token, 9)` via SPELL; share = 9*100,000/1,000,000 = 0 debt shares.
3. Receive 9 tokens with no debt share increase.
4. Loop borrow() many times in one transaction to drain the vault.
**How found:** Code review of borrow() share accounting; noticed missing zero-share check and reasoned about rounding when amount*totalShare < totalDebt.
**Exploitation:** Attacker repeatedly calls borrow() with amounts below the share-per-debt threshold, each call transferring tokens out while adding zero debt shares, accumulating free funds until the vault is drained.
**Insight:** In share-based lending, check that computed shares are nonzero after rounding; any borrow path where amount*sharePerDebt rounds to zero lets an attacker loop tiny borrows to extract funds for free.