# Lender can take borrower's collateral before first payment due

TellerV2.isLoanDefaulted ignores first payment due date, so a lender can withdraw borrower collateral after PaymentDefault seconds even before first repayment is due.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: cducrest-brainbot
- Disclosed: 2023-03-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-teller-judging/issues/92
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** TellerV2 lending contract / CollateralManager.withdraw
**Root cause:** isLoanDefaulted() checks only elapsed time since loan start against PaymentDefaultDuration and bypasses the 1-day grace period, without comparing against the first payment due date computed by calculateNextDueDate().
**Steps:**
1. Set market PaymentCycleType.Seconds with PAYMENT_CYCLE_SEC=3600 and PAYMENT_DEFAULT_SEC=1 via MarketRegistry.setPaymentCycle/setPaymentDefaultDuration
2. Borrower submits collateral bid via submitCollateralBid()
3. Lender accepts bid via acceptBid(bidId)
4. skip(PAYMENT_DEFAULT_SEC+1)
5. Lender calls CollateralManager.withdraw(bidId) which calls TellerV2.isLoanDefaulted() and returns true
6. Collateral is transferred to lender; second withdraw reverts 'No collateral balance for asset'
**How found:** Code review of CollateralManager.withdraw -> TellerV2.isLoanDefaulted, noticing the default check ignores calculateNextDueDate and the grace period, then writing a Foundry PoC with 1-second default duration.
**Exploitation:** Market operator (who may also be the lender) configures a tiny PaymentDefaultDuration; lender accepts borrower bid then immediately calls CollateralManager.withdraw to seize collateral before the first payment deadline.
**Insight:** When auditing lending/loan contracts, compare the liquidation/default predicate against the repayment schedule function (next due date) — a default check based only on elapsed time since loan start can fire before the first installment is even due.