# LenderCommitmentForwarder#updateCommitment can be front-run by malicious borrower to cause lender to over-commit funds

updateCommitment overwrites maxPrincipal, so a borrower front-runs a lender's expiry update with a loan, then borrows again after reset, doubling exposure.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: 0x52
- Disclosed: 2023-03-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-teller-judging/issues/176
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:race-condition

**Target:** LenderCommitmentForwarder.updateCommitment (Solidity contract)
**Root cause:** updateCommitment overwrites the entire commitment struct including maxPrincipal, resetting the remaining lendable amount instead of tracking allocated principal.
**Steps:**
1. Lender A creates commitment for 100e6 USDC against ETH via LenderCommitmentForwarder
2. A calls `updateCommitment` to change only expiration
3. Borrower B front-runs the tx with a loan of 100e6 USDC against the commitment
4. A's updateCommitment executes, resetting maxPrincipal back to 100e6 USDC
5. B takes a second loan of 100e6 USDC against the same commitment
6. A has now lent 200e6 USDC despite intending only 100e6
**How found:** Recognized the same approve-vs-increaseAllowance pattern: full-struct overwrite resets a counter that should only be incremented, and updateCommitment is called more often (expiry, collateral ratio, interest rate).
**Exploitation:** Borrower watches the mempool for updateCommitment calls, front-runs with a max-size loan, lets the reset land, then borrows again to double the lender's exposure.
**Insight:** Any setter that overwrites a remaining-capacity field (allowance, maxPrincipal, quota) is front-runnable: watch for update functions that reset a decremented counter rather than tracking allocated amount separately.