# Not properly tracking debt accrual leads mintOpenInterestDebt() to lose twTap rewards

Penrose.mintOpenInterestDebt computes rewards from live totalBorrow vs USDO supply, so bridging USDO out before distribution inflates minted twTap rewards.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca
- Credited: 0xadrii
- Disclosed: 2024-02-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-tapioca-judging/issues/120
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-25
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation vuln:reward-distribution

**Target:** Penrose.mintOpenInterestDebt() reward distribution
**Root cause:** Reward amount is derived from current USDO totalSupply vs computeTotalDebt() (live totalBorrow), rather than tracked accrued debt; repayments and cross-chain USDO bridging change supply without changing debt.
**Steps:**
1. Note mintOpenInterestDebt mints `totalUsdoDebt - usdoSupply` to twTap.
2. Borrow 1000 USDO: totalUsdoDebt and usdoSupply both rise, delta unchanged.
3. Bridge the 1000 USDO to another chain: usdoSupply drops, totalBorrow (debt) unchanged.
4. Owner calls mintOpenInterestDebt(); minted amount = inflated debt-supply delta.
**How found:** Code reading of mintOpenInterestDebt revealed debt is queried live from totalBorrow rather than tracked, so supply-changing actions (repay, bridge) desync the two values.
**Exploitation:** Attacker borrows USDO then bridges it off-chain right before a weekly reward epoch; the supply drop inflates the minted reward amount, diluting/over-minting USDO and stressing the peg.
**Escalation:** Repeatable each weekly epoch; excess USDO supply threatens stablecoin peg.
**Insight:** When a reward/fee formula subtracts a live token supply from a live debt figure, look for any action that changes one side without the other (repay, bridge, burn) to skew the delta.