# Borrower collateral that they are owed can get stuck in Vault and not sent back to them after calling `repay`

In Real Wagmi's repay, a combined if/else skips crediting liquidationBonus when fees are below MINIMUM_AMOUNT, so borrower collateral stays stuck in the Vault.

- Payout: Contest reward
- Severity: medium
- Program: Real Wagmi
- Credited: HHK
- Disclosed: 2023-10-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-10-real-wagmi-judging/issues/122
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-real-wagmi%3AM-8
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LiquidityBorrowingManager.repay / Vault collateral transfer
**Root cause:** A single if/else couples the collateralBalance>0 check with the fee>MINIMUM_AMOUNT check; when fees are too low the else branch runs and liquidationBonus is never incremented, so the Vault transfer omits the collateral.
**Steps:**
1. Borrower calls `borrow` in LiquidityBorrowingManager
2. Borrower calls `increaseCollateralBalance` with a large collateral amount
3. Borrower calls `repay` shortly after, before fees accrue past MINIMUM_AMOUNT
4. In repay, `collateralBalance > 0` is true but `(currentFees + borrowing.feesOwed)/COLLATERAL_BALANCE_PRECISION > MINIMUM_AMOUNT` is false, so the else branch sets `currentFees = borrowing.dailyRateCollateralBalance` and `liquidationBonus` is not incremented
5. `Vault.transferToken(holdToken, address(this), borrowedAmount + liquidationBonus)` omits the collateral, leaving it stuck in the Vault
**How found:** Code reading of the repay fee/liquidationBonus logic; noticed the combined if/else means the collateral-credit branch is skipped whenever accrued fees fall below MINIMUM_AMOUNT, even though collateralBalance > 0.
**Exploitation:** No attacker; the borrower self-inflicts loss by repaying quickly (same block or shortly after) or with low-decimal tokens, causing their collateral to remain locked in the Vault permanently.
**Insight:** When a single if/else gates two independent conditions (collateral presence vs fee threshold), the else branch silently drops one side effect; check that every branch that should credit a balance does so regardless of the other condition.