# The `exchangeRateStored()` function allows front-running on repayments

Repayments increase totalRedeemable, raising exchangeRateStored; attacker mints UTokens before a repay and redeems after to capture interest.

- Payout: Contest reward
- Severity: medium
- Program: Union
- Credited: ozoooneth
- Disclosed: 2023-02-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-union-judging/issues/8
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-union%3AM-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** UToken lending market contract (exchangeRateStored/mint/redeem)
**Root cause:** _repayBorrowFresh adds interest to totalRedeemable, which immediately raises exchangeRateStored; mint/redeem use the spot rate with no time-weighting or exit fee, so a deposit made just before a repayment captures a share of that interest.
**Steps:**
1. Attacker mints UTokens via `uToken.mint(100 ether)` before a pending repayment (front-run).
2. Victim calls `uToken.repayBorrow(ALICE, borrowed+interest)`; `_repayBorrowFresh` adds `toRedeemableAmount` to `totalRedeemable`, raising `exchangeRateStored()` from 1e18 to ~1.000084e18.
3. Attacker calls `uToken.redeem(uToken.balanceOf(BOB), 0)` and receives more DAI than deposited (100.0084e18 vs 100e18).
**How found:** Code reading of exchangeRateStored() and _repayBorrowFresh() showed totalRedeemable is bumped by interest at repay time while mint/redeem price off the instantaneous rate, suggesting a sandwich; confirmed with a Foundry PoC (testMintRedeemSandwich).
**Exploitation:** Sandwich a repayment: mint UTokens in the block before the repay, redeem immediately after; profit equals the attacker's pro-rata share of the interest added to totalRedeemable, repeatable on every repayment.
**Insight:** In lending markets, any state variable that raises the share price at a discrete event (interest booked on repay) is sandwichable if mint/redeem use the spot exchange rate; check whether interest accrual is time-weighted or exit-fee protected.