# Attackers can force surge to never update the collateralization ratio

Integer truncation in Surge's collateral ratio update lets an attacker spam 1-wei deposits to keep the ratio change at zero, freezing adaptive pricing.

- Payout: Contest reward
- Severity: medium
- Program: Surge
- Credited: usmannk
- Disclosed: 2023-02-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-surge-judging/issues/109
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Pool.sol getCollateralRatioMantissa lending pool
**Root cause:** Collateral ratio change is computed as `timeDelta * _maxCollateralRatioMantissa / _collateralRatioRecoveryDuration`; when recoveryDuration exceeds maxCollateralRatioMantissa and timeDelta is small, integer division truncates change to zero.
**Steps:**
1. Configure pool with `_maxCollateralRatioMantissa = 1e14` (e.g. WBTC loan / DAI collateral) and `_collateralRatioRecoveryDuration = 1e15`.
2. Attacker deposits 1 wei of loan token more often than every 10 seconds.
3. Each call resets lastUpdateTime so `timeDelta * _maxCollateralRatioMantissa < _collateralRatioRecoveryDuration`, making `change = 0`.
4. Collateral ratio never recovers/updates; borrows continue at stale rate.
**How found:** Code reading of getCollateralRatioMantissa revealed integer division truncation; author reasoned about parameter combinations (WBTC/DAI pool, test recoveryDuration of 1e15) where timeDelta*maxRatio < recoveryDuration yields zero change.
**Exploitation:** Repeated tiny deposits (1 wei) at intervals shorter than recoveryDuration/maxRatio keep the truncation at zero, permanently stalling the adaptive collateral ratio and pool exchange rate while borrowing remains enabled at the stale price.
**Insight:** When a linear-update formula divides by a duration parameter, check whether realistic parameter pairs make the per-block increment truncate to zero, and whether an attacker can reset the time delta cheaply (L2 low block times, dust deposits).