# First pool borrower pays extra interest

Ajna pool's first borrower accrues interest from the last inflator update instead of borrow time, overpaying interest.

- Payout: Contest reward
- Severity: medium
- Program: Ajna
- Credited: 0xkaden
- Disclosed: 2023-09-26
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-09-ajna-judging/issues/26
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-ajna%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:regression technique:source-review vuln:accounting-error

**Target:** ERC20Pool drawDebt / interest accrual (Solidity)
**Root cause:** _accruePoolInterest only sets isNewInterestAccrued when t0Debt != 0, and _updateInterestState only resets inflator when isNewInterestAccrued or post-execution debt == 0; on first borrow both are false so inflator/inflatorUpdate stay stale.
**Steps:**
1. Call `ERC20Pool.drawDebt` when pool has 0 debt but inflatorUpdate is old (e.g. `skip(100 days)` after liquidity added).
2. Observe `_accruePoolInterest` skips update because `poolState_.t0Debt == 0`, leaving `isNewInterestAccrued == false`.
3. After `BorrowerActions.drawDebt` increments debt, `_updateInterestState` sees `isNewInterestAccrued == false` and `poolState_.debt != 0`, so inflator not reset.
4. Borrower's debt accrues interest from stale `inflatorUpdate` timestamp, inflating owed interest.
**How found:** Code review of interest accrual flow: noticed _accruePoolInterest guards on t0Debt != 0 and _updateInterestState guards on isNewInterestAccrued || debt == 0, leaving a gap when debt transitions 0->nonzero; confirmed by adding skip(100 days) to existing borrow test.
**Exploitation:** LP funds pool long before announcing; first borrower draws debt and pays interest backdated to the old inflatorUpdate, transferring extra value to the pool/LP.
**Insight:** When state-update logic has two branches keyed on before/after values, check the transition case where a value goes from zero to nonzero—both guards can be false simultaneously, skipping the reset.