# Vault: `_update_debt` does not accrue interest

Vault._update_debt sets last_debt_update to block.timestamp before computing interest, so elapsed time is always zero and no debt interest ever accrues.

- Payout: Contest reward
- Severity: high
- Program: Unstoppable
- Credited: 0x00ffDa
- Disclosed: 2023-06-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-unstoppable-judging/issues/167
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** Vyper margin-dex Vault contract, _update_debt / _debt_interest_since_last_update
**Root cause:** _update_debt writes self.last_debt_update[_debt_token] = block.timestamp before calling _debt_interest_since_last_update, so block.timestamp - last_debt_update is always 0 and the interest term evaluates to zero.
**Steps:**
1. Read Vault.vy _update_debt: it sets `self.last_debt_update[_debt_token] = block.timestamp` then adds `self._debt_interest_since_last_update(_debt_token)` to total_debt_amount.
2. Read _debt_interest_since_last_update: returns `(block.timestamp - self.last_debt_update[_debt_token]) * rate * total_debt_amount / PERCENTAGE_BASE / PRECISION`.
3. Observe the timestamp was just overwritten, so the delta is 0 and the function returns 0.
4. Conclude total_debt_amount never grows with interest across any borrow/lend operation.
**How found:** Code reading of the debt-update ordering: noticed the state write to last_debt_update precedes the interest calculation that depends on it, making the elapsed-time term identically zero.
**Insight:** When auditing accrual/interest logic, check ordering of state writes vs. reads of the same timestamp accumulator; a write-before-read of last_update silently zeroes any time-delta-based accrual.