# Utilisation Can Be Manipulated Far Above 100%

Arcadia's uncapped utilisation let an attacker donate tokens to an empty pool, borrow them back, and inflate interest to steal from later depositors.

- Payout: Contest reward
- Severity: medium
- Program: Arcadia
- Credited: Bandit
- Disclosed: 2023-12-17
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-12-arcadia-judging/issues/93
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** LendingPool utilisation/interest-rate calculation
**Root cause:** Utilisation (_assetsBorrowed/_assetsLoaned) is not capped at 100%, so direct token donations let borrows exceed loans and drive interest rate arbitrarily high.
**Steps:**
1. Deposit 100 assets into tranche (empty pool).
2. Directly `transfer(1e18)` stable tokens into the LendingPool address.
3. Borrow `1e18` against collateral; transfer succeeds because donated tokens cover it, utilisation >>100%.
4. Warp 2 minutes; interest accrues massively.
5. Victim mints/deposits into tranche.
6. Attacker `tranche.withdraw(1e5,...)` burning 22 shares, extracting 100000 assets from a 100-asset deposit.
**How found:** Inspired by Silo Finance Immunefi report; noticed utilisation formula lacks a 100% cap and that direct ERC20 transfers bypass the loan-balance check that would otherwise revert oversized borrows.
**Exploitation:** Attacker seeds an empty pool, donates tokens to allow an oversized self-borrow, inflating utilisation and thus interest rate; after time passes and a victim deposits, attacker withdraws inflated shares to drain the victim's funds.
**Escalation:** Interest accrual over time compounds the inflated rate; attacker can borrow back the donated tokens so donation is not lost.
**Insight:** In lending protocols, check whether utilisation/interest formulas are capped and whether direct token transfers can desync accounting from actual balances to bypass borrow limits.