# Incorrect calculations of borrowingCollateral leads to DoS for positions in the current tick range due to underflow

In LiquidityBorrowingManager, borrowingCollateral computed as borrowedAmount - holdTokenBalance underflows when a position's liquidity sits in the current tick range, reverting borrows and DoSing those positions.

- Payout: Contest reward
- Severity: medium
- Program: Real Wagmi
- Credited: 0xReiAyanami
- Disclosed: 2023-10-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-10-real-wagmi-judging/issues/86
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-real-wagmi%3AM-5
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** LiquidityBorrowingManager.sol borrow() collateral calculation
**Root cause:** borrowingCollateral is computed as cache.borrowedAmount - cache.holdTokenBalance, but when liquidity is in the current tick range both tokens are transferred and saleToken is swapped into holdTokenBalance, making holdTokenBalance exceed borrowedAmount and the subtraction underflow.
**Steps:**
1. Open a borrow against a position whose liquidity is in the current tick range.
2. During liquidity extraction both holdToken and saleToken are transferred to LiquidityBorrowingManager.
3. saleToken is swapped to holdToken and added to cache.holdTokenBalance, so holdTokenBalance == borrowedAmount + swapped saleToken amount.
4. `uint256 borrowingCollateral = cache.borrowedAmount - cache.holdTokenBalance;` underflows and the tx reverts.
5. Borrows for that position are permanently unavailable until the tick range moves.
**How found:** Code reading of the borrow flow: noticed that in-range positions return both tokens, and the saleToken swap inflates holdTokenBalance, making the subtraction order in the collateral calculation suspect.
**Insight:** When a formula subtracts a 'borrowed' amount from a post-swap token balance, check whether in-range LP extraction can return both tokens and inflate the balance above the borrowed amount, inverting the intended subtraction.