# setLenderManager may cause some Lenders to lose their assets

Changing lenderManager after loans claimed as NFT makes getLoanLender return the stale old manager address, so repayments go to the wrong contract and lenders lose funds.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: MiloTruck
- Disclosed: 2023-03-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-teller-judging/issues/339
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** TellerV2 lending contract (Solidity)
**Root cause:** claimLoanNFT stores the current lenderManager address in bid.lender, and getLoanLender compares bid.lender to the current lenderManager; after setLenderManager changes the address, the comparison fails and the stale old manager is treated as the lender.
**Steps:**
1. Lender calls `claimLoanNFT(_bidId)`; bid.lender is set to `address(lenderManager)` (old manager).
2. Owner calls `setLenderManager(newManager)` via reinitializer(8).
3. Borrower repays; `getLoanLender` sees bid.lender != current lenderManager, returns old manager address.
4. `safeTransferFrom` sends repayment to the old lenderManager instead of the NFT owner.
**How found:** Code reading of claimLoanNFT storing the live lenderManager address and getLoanLender comparing against the mutable current lenderManager, spotting the stale-reference mismatch after a manager change.
**Exploitation:** No attacker action required; a legitimate owner call to setLenderManager causes repayments for all previously NFT-claimed loans to be routed to the deprecated lenderManager, stranding lender funds.
**Insight:** When a contract stores a mutable singleton's address as a sentinel inside per-record state, any later change to that singleton silently breaks the sentinel comparison; use an immutable magic value instead of the live address.