# Wrong `accLoanRatePerSeconds` in `repay()` can lead to underflow

Emergency repay() recomputed accLoanRatePerSeconds using reduced borrowedAmount, inflating the percentage and underflowing, blocking lenders from emergency liquidity restoration.

- Payout: Contest reward
- Severity: medium
- Program: Real Wagmi
- Credited: HHK
- Disclosed: 2023-10-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-10-real-wagmi-judging/issues/119
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-real-wagmi%3AM-7
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** LiquidityBorrowingManager.repay() emergency liquidity restoration
**Root cause:** repay() subtracts a percentage of missing collateral from accLoanRatePerSeconds computed against the reduced borrowedAmount (after removedAmt) instead of the original amount, inflating the percentage above accLoanRatePerSeconds and underflowing.
**Steps:**
1. Borrow via borrowingManager.borrow() with multiple loans.
2. Advance time ~48-72h so collateralBalance is deeply negative (missing fees).
3. Call repay() with isEmergency=true for a borrowingKey.
4. Observe subtraction `accLoanRatePerSeconds - mulDiv(-collateralBalance, BP, borrowedAmount+removedAmt)` underflows and reverts with Panic.
**How found:** Reasoned that resetting dailyRateCollateralBalance to 0 on partial emergency close requires re-deriving missing collateral from a smaller borrowedAmount, which inflates the percentage; tested with time-increased emergency repay and observed revert.
**Insight:** When a state variable is scaled by a denominator that shrinks after partial withdrawal, recomputing a rate against the new denominator can exceed the stored accumulator and underflow; check accumulator-subtraction math after any balance reduction.