# wrong bToken's exchangeRateStored used for calculate ColleteralValue

Blueberry's getIsolatedCollateralValue multiplied vault shares by the debt token's bToken exchangeRate instead of the underlying token's, miscomputing collateral value and risk.

- Payout: Contest reward
- Severity: high
- Program: Blueberry
- Credited: mert_eren
- Disclosed: 2023-07-12
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-07-blueberry-judging/issues/117
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AH-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** BlueBerryBank.sol getIsolatedCollateralValue / getPositionRisk
**Root cause:** getIsolatedCollateralValue uses ICErc20(banks[pos.debtToken].bToken).exchangeRateStored() to convert underlyingVaultShare to underlying amount, but shares were minted against the underlying token's bToken, so the wrong exchange rate is applied.
**Steps:**
1. Read getIsolatedCollateralValue: underlyingAmount = exchangeRateStored() * pos.underlyingVaultShare / PRICE_PRECISION using banks[pos.debtToken].bToken.
2. Note lend() stores pos.underlyingVaultShare += ISoftVault(bank.softVault).deposit(amount), i.e. bToken mint amount = amount/exchangeRateStored of the underlying token's bToken.
3. Observe all bTokens have different exchangeRates, so using the debtToken's bToken yields a wrong underlyingAmount.
4. Feed the wrong cv into getPositionRisk to skew liquidation/overcollateralization checks.
5. Fix: use ICErc20(banks[pos.underlyingToken].bToken).exchangeRateStored().
**How found:** Code reading of getIsolatedCollateralValue versus lend(): noticed the share was minted via the underlying token's bToken but the valuation read the debtToken's bToken exchangeRate.
**Exploitation:** Not described beyond miscomputed collateral value feeding getPositionRisk; no concrete attack sequence or capital provided.
**Insight:** When a position stores vault shares rather than amounts, verify the conversion back to underlying uses the same token's exchange rate that minted the shares; debt and collateral bTokens diverge in exchangeRate.