# Attackers may skip the collateral ratio recovery duration to inflate collateralization ratios and steal funds

Gifting loan tokens to a Surge pool flips utilization into Surge mode, letting attacker skip collateral ratio recovery and borrow at inflated ratio to drain funds.

- Payout: Contest reward
- Severity: medium
- Program: Surge
- Credited: usmannk
- Disclosed: 2023-02-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-surge-judging/issues/130
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Pool.sol collateral ratio / utilization calculation
**Root cause:** Collateral ratio direction is chosen by comparing live utilization to _surgeMantissa; a small loan-token gift raises live utilization so a large timeDelta is applied as a ratio increase instead of decrease.
**Steps:**
1. Identify pool sitting just under _surgeMantissa with large timeDelta since last interaction
2. Gift a small amount of loan token to the pool contract to push _util above _surgeMantissa
3. Trigger next interaction; contract applies timeDelta * _maxCollateralRatioMantissa / _collateralRatioRecoveryDuration as an increase
4. Borrow at the inflated maximum collateralization ratio, extracting more loan token than collateral warrants
**How found:** Noticed ratio direction depends on live balanceOf-based utilization; hypothesized that a donation could flip the branch and misapply a large timeDelta as recovery instead of fall.
**Exploitation:** Attacker transfers a small loan-token amount to the pool, then calls a state-changing function so the ratio jumps from ~0 to max, and borrows against collateral at the inflated exchange rate, draining depositors.
**Insight:** When a time-based accumulator picks increase vs decrease based on a live, manipulable balance-derived value, a tiny donation can flip the branch and apply a large elapsed time in the wrong direction.