# Lender is able to steal borrowers collateral by calling rollLoan  with unfavourable terms on behalf of the borrower.

Lender calls provideNewTermsForRoll then rollLoan on borrower's behalf, forcing huge interest and zero added collateral, forcing borrower to forfeit collateral.

- Payout: Contest reward
- Severity: medium
- Program: Cooler
- Credited: 0xMosh
- Disclosed: 2023-08-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-08-cooler-judging/issues/26
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** Cooler.sol lending contract (rollLoan/provideNewTermsForRoll)
**Root cause:** rollLoan lacks an owner/borrower access check, and provideNewTermsForRoll lets the lender set arbitrary interest rate and loanToCollateral; interestFor then inflates loan.amount while newCollateralFor returns 0 because loanToCollateral is manipulated.
**Steps:**
1. Borrower requests loan: `requestLoan(1000 debt, 5% interest, 10 loanToCollateral, 1 year)`; lender clears it.
2. Lender calls `provideNewTermsForRoll(loanID, 10000000% interest, 1000 loanToCollateral, 1 year)`.
3. Lender calls `rollLoan(loanID)` on behalf of borrower (no access check).
4. interestFor(amount, rate, duration) returns huge interest added to loan.amount (e.g. 3000).
5. newCollateralFor computes collateralFor(loan.amount, loanToCollateral) which is <= loan.collateral, returning 0, so no extra collateral required.
6. Borrower must repay 4050 debt tokens to recover $1500 collateral, or forfeit it.
**How found:** Code review of rollLoan access control and the interaction between provideNewTermsForRoll-controlled rate/loanToCollateral and interestFor/newCollateralFor math.
**Exploitation:** Lender waits for a cleared loan, sets punitive terms via provideNewTermsForRoll, then calls rollLoan directly since it is unpermissioned, inflating debt beyond collateral value and forcing borrower default/forfeiture.
**Insight:** When a roll/refinance function recomputes debt from parameters the counterparty can set, check both who may call it and whether the recomputed collateral requirement can be driven to zero by the same manipulated parameter.