# When APR late rate is lower than APR, an OCC locker bullet loan borrower can pay way less interests by calling the loan

OCC_Modular callLoan charges only one interval's interest/late fee, letting a bullet borrower skip multiple missed payments when APRLateFee < APR.

- Payout: Contest reward
- Severity: medium
- Program: Zivoe
- Credited: 0x73696d616f
- Disclosed: 2024-03-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-zivoe-judging/issues/97
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-zivoe%3AM-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** OCC_Modular.sol callLoan / amountOwed
**Root cause:** callLoan settles using amountOwed which computes interest for a single paymentInterval and lateFee only from paymentDueBy, ignoring all previously missed intervals; so a borrower overdue by N intervals pays one interval's interest plus late fee instead of N.
**Steps:**
1. Create bullet loan (paymentSchedule=0) with APR=1000, APRLateFee=500, term=10, paymentInterval=7d, gracePeriod=28d.
2. Borrower accepts offer and stops paying.
3. Warp to end of term (info[3] + info[4]*term), accumulating multiple missed intervals.
4. Borrower calls `callLoan(loanId)`; amountOwed returns principal + one interval interest + lateFee from paymentDueBy only.
5. Compare total paid vs paying each interval on time: callLoan pays ~0.077 interest vs ~0.767 for normal/late per-interval payments.
**How found:** Code reading of amountOwed and callLoan: noticed callLoan invokes amountOwed once, which only accounts for a single paymentInterval of interest and lateFee accrued since paymentDueBy, so multiple missed intervals are not charged.
**Exploitation:** Borrower intentionally misses several payment intervals (grace period can exceed interval, e.g. 7d interval / 28d grace), then at loan end calls callLoan to settle, paying only one interval's interest plus late fee and skipping the remaining missed intervals' interest and late fees, shifting loss to protocol/depositors.
**Insight:** When a settle-early/close function reuses a per-period accrual helper, check whether it charges for all elapsed periods or just one; compare close-path cost against the pay-each-period path when penalty rate < base rate.