# Lender can front-run `rollLoan` and call `provideNewTermsForRoll` with unfavorable terms

Lender front-runs borrower's rollLoan by re-calling provideNewTermsForRoll with extreme interest rate, forcing borrower to accept unfavorable terms.

- Payout: Contest reward
- Severity: medium
- Program: Cooler
- Credited: 0xbepresent
- Disclosed: 2023-08-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-08-cooler-judging/issues/243
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:race-condition

**Target:** Cooler.sol rollLoan / provideNewTermsForRoll
**Root cause:** rollLoan reads current loan terms set by provideNewTermsForRoll without any borrower-specified slippage bound, so terms can be swapped between proposal and acceptance.
**Steps:**
1. Borrower A borrows from lender B, creating a loan
2. Lender B calls `provideNewTermsForRoll` with reasonable terms
3. A calls `rollLoan` to accept the proposed terms
4. B observes A's pending tx in mempool and front-runs with `provideNewTermsForRoll` setting an extremely high interest rate
5. A's `rollLoan` executes against the new unfavorable terms
**How found:** Manual review of the two-step propose/accept flow in rollLoan and provideNewTermsForRoll, noticing no bound on accepted terms and mempool ordering risk.
**Exploitation:** Lender monitors mempool for borrower's rollLoan tx, submits a higher-gas provideNewTermsForRoll with extreme interest rate, causing borrower's rollLoan to bind them to the inflated rate.
**Insight:** Any two-step propose/accept pattern where the acceptor's tx reads live on-chain state is front-runnable; check whether the accepting call enforces a user-supplied max/min bound on the parameter being accepted.