# EMI last payment not handled perfectly could lead to borrower losing collaterals

Teller's calculateAmountOwed prorates the final EMI payment by owedTime, so an early last payment underpays principal and leaves the loan open, risking collateral liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: RaymondFam
- Disclosed: 2023-03-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-teller-judging/issues/315
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-8
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** TellerV2 loan repayment / V2Calculations library
**Root cause:** In the last payment cycle, calculateAmountOwed still multiplies (owedPrincipal+interest) by owedTime/paymentCycle and takes min(owedAmount-interest, owedPrincipal), so paying before the cycle fully elapses yields a duePrincipal below the true remaining principal.
**Steps:**
1. Borrower repays on schedule each cycle; on the last cycle repays slightly early (owedTime < paymentCycle).
2. calculateAmountOwed computes owedAmount = (owedPrincipal_+interest_)*owedTime/paymentCycle and duePrincipal_ = min(owedAmount-interest_, owedPrincipal_).
3. In _repayLoan, paymentAmount >= _owedAmount is false, so bid.state is not set to PAID and collateralManager.withdraw is not called.
4. Borrower assumes loan settled; after bidDefaultDuration the loan is delinquent and lender calls CollateralManager.withdraw to seize collateral.
**How found:** Code review of the ternary logic in calculateAmountOwed for the isLastPaymentCycle branch, noticing owedAmount is still time-prorated rather than being the full remaining balance.
**Exploitation:** Lender waits for borrower's slightly-early final payment to leave a residual principal unpaid, then after the default duration triggers liquidation and withdraws all collateral while having received nearly all principal plus interest.
**Insight:** When auditing amortization/EMI math, check that the final-cycle branch returns the entire remaining balance rather than reusing the per-cycle proration formula; early payment within the last cycle is a realistic trigger.