# Secondary Big Bang market rates can be manipulated due to not triggering penrose.reAccrueBigBangMarkets(); when leveraging

Leverage buyCollateral borrows without triggering penrose.reAccrueBigBangMarkets(), letting attackers inflate ETH market debt then accrue secondary markets to manipulate their interest rates.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca
- Credited: 0xadrii
- Disclosed: 2024-02-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-02-tapioca-judging/issues/128
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-29
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:incomplete-fix technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Big Bang leverage module (BBLeverage.buyCollateral) and Penrose rate accrual
**Root cause:** The fix for cross-market interest-rate manipulation only re-accrues secondary markets when bigBangEthMarket borrows; the leverage path calls _borrow() directly without invoking penrose.reAccrueBigBangMarkets(), so secondary markets can still be accrued against a freshly inflated ETH debt.
**Steps:**
1. Borrow a huge amount in the ETH market via the leverage module `buyCollateral()` (which calls `_borrow()` and inflates ETH total debt) without triggering `penrose.reAccrueBigBangMarkets()`.
2. Trigger accrual on non-ETH Big Bang markets; their interest rate computation reads the inflated ETH market debt.
3. Secondary market interest rates are manipulated to the attacker's advantage.
**How found:** Recognized that a prior C4/Spearbit finding (rate manipulation via unaccrued secondary markets) was patched only for the direct ETH borrow path via `reAccrueBigBangMarkets()`, then checked whether the leverage module's `_borrow()` also increments debt without that guard — it does.
**Exploitation:** Attacker uses leverage `buyCollateral()` to inflate ETH market total debt, then accrues non-ETH markets so their rate calculation sees the inflated ETH debt, skewing secondary market rates for profit.
**Insight:** When a fix gates a mitigation on a specific caller (msg.sender == bigBangEthMarket), enumerate every other code path that mutates the same state (here debt via leverage `_borrow`) — alternate borrow entrypoints bypass the guard.