# Users can borrow all loan tokens

Surge pool's utilization-rate check could be bypassed by depositing loan tokens, borrowing the rest, then withdrawing the deposit in one transaction, draining all liquidity.

- Payout: Contest reward
- Severity: medium
- Program: Surge
- Credited: shaka
- Disclosed: 2023-02-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-surge-judging/issues/106
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-2
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** Lending pool borrow() utilization check (Pool.sol)
**Root cause:** The surge-threshold utilization check in borrow() only evaluates the post-borrow state; a same-transaction deposit inflates the loan-token balance so the check passes, then the deposit is withdrawn, leaving utilization at 100%.
**Steps:**
1. Flash-loan the pool's full loan-token balance.
2. Call `pool.deposit(amount)` to inflate pool balance.
3. Call `pool.borrow(loanTokenBalance)` — utilization check passes because deposit is counted.
4. Call `pool.withdraw(amount)` to remove the deposit.
5. Repay flash loan and keep borrowed loan tokens; utilization now 100%.
**How found:** Code review of borrow() utilization check at Pool.sol L477-478; noticed the check uses current balance which a same-tx deposit can manipulate.
**Exploitation:** Attacker flash-loans the pool's loan-token balance, deposits it to satisfy the surge-threshold check, borrows the remaining loan tokens, withdraws the deposit, and repays the flash loan — netting all pool liquidity in one transaction.
**Escalation:** Repeatable on every repayment/new deposit by mempool-tracking, driving collateral ratio toward zero; suppliers cannot withdraw.
**Insight:** When a utilization/ratio check reads live token balances, test whether a same-transaction deposit-then-withdraw can inflate the denominator to pass the check while the borrow still drains the pool.