# JUSDBank users can bypass individual collateral borrow limits

JUSDBank's borrow path enforces per-collateral borrow caps but withdraw uses a different safety check, letting users exceed caps via flash-loan collateral cycling.

- Payout: Contest reward
- Severity: medium
- Program: Jojo
- Credited: 0x52
- Disclosed: 2023-04-11
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-04-jojo-judging/issues/403
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:flash-loan

**Target:** JUSDBank lending contract (JUSDV1)
**Root cause:** borrow() validates with _isAccountSafeAfterBorrow which enforces per-collateral borrow caps, while withdraw() uses a different safety check that omits those caps, so collateral can be withdrawn after borrowing against it.
**Steps:**
1. Deposit $30,000 WETH as collateral.
2. Flash-loan $30,000 WBTC and deposit it too.
3. Call `borrow(20000 JUSD, ...)` — passes _isAccountSafeAfterBorrow since combined collateral supports it.
4. Withdraw all WBTC via `withdraw()` to repay the flash loan; withdraw path does not re-check per-collateral borrow caps.
5. Result: 20,000 JUSD borrowed against only WETH, exceeding the intended per-collateral cap.
**How found:** Code reading: noticed borrow() and withdraw() use different safety-check functions (_isAccountSafeAfterBorrow vs the withdraw-path check), hypothesizing the cap enforced on borrow is not enforced on withdraw.
**Exploitation:** Attacker uses a flash loan to temporarily inflate collateral of a second asset, borrows past the per-collateral cap, then withdraws the temporary collateral to repay the loan, leaving an oversized position on the remaining collateral.
**Insight:** When a protocol enforces limits in one entrypoint (borrow) but validates health in another (withdraw) with a different function, test whether temporary collateral from a flash loan can be used to pass the stricter check then removed via the laxer one.