# The use of spot data when discounting is subjected to manipulation

wfCash redemption with insufficient fCash prices via getPrincipalFromfCashBorrow using spot utilization, letting deposit-driven rate manipulation inflate cash returned.

- Payout: Contest reward
- Severity: medium
- Program: Notional Update 5
- Credited: xiaoming90
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-notional-update-5-judging/issues/36
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-notional-update-5%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** wfCash wrapper _sellfCash / CalculationViews.getPrincipalFromfCashBorrow
**Root cause:** When wrapper fCash balance is insufficient, prime cash owed is computed from spot interest rate/utilization via the two-kink IRM instead of a manipulation-resistant price.
**Steps:**
1. Redeem wfCash before maturity with fCashToSell exceeding wrapper's fCash balance so `hasInsufficientfCash` is true
2. `_sellfCash` calls `NotionalV2.getPrincipalFromfCashBorrow(currencyId, fCashToSell, maturity, 0, block.timestamp)`
3. Deposit prime cash (own or flash-loan) into the market to raise `totalCashUnderlying`, lowering utilization below Kink 1
4. Lower utilization drops the interest rate sharply, so fCash is discounted less and `primeCashToWithdraw` is larger
5. Receive inflated prime cash; withdraw deposited liquidity
**How found:** Code-read of `_sellfCash` insufficient-fCash branch, noting `getPrincipalFromfCashBorrow` consumes spot utilization/rate and that the two-kink IRM makes rate highly sensitive just below Kink 1.
**Exploitation:** Attacker deposits prime cash to push utilization from just above Kink 1 into the steep low-rate region, then redeems wfCash so the discounted present value is computed at the lower rate, receiving more cash than fair; gain is protocol loss in a zero-sum.
**Insight:** Redemption/withdrawal paths that fall back to a view-based pricing function using spot utilization are manipulable by depositing to shift the denominator; check whether the discount rate sits on a steep segment of a kinked IRM where small utilization moves swing price.