# Unassigned pool earnings can be stolen when a maturity borrow is liquidated by depositing at maturity with 1 principal

Liquidation of a maturity borrow skips unassigned earnings; attacker borrows and deposits 1 principal at maturity to claim the full fee.

- Payout: Contest reward
- Severity: high
- Program: Interest Rate Model
- Credited: 00xSEV
- Disclosed: 2024-04-06
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-04-interest-rate-model-judging/issues/114
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:chained technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Market.sol noTransferRepayAtMaturity / depositAtMaturity
**Root cause:** Market::liquidate calls noTransferRepayAtMaturity with canDiscount=false, so unassigned earnings are not converted to earningsAccumulator and remain claimable by the next maturity depositor.
**Steps:**
1. Alice deposits 10_000 ether and borrows at maturity using backup, then max-borrows floating to become liquidatable.
2. Liquidator calls `market.liquidate(ALICE, type(uint256).max, market)`, wiping the maturity borrow while ignoring unassigned earnings.
3. Attacker deposits 10, borrows 1 at maturity so floatingBackupBorrowed=1 > supply=0.
4. Attacker calls `market.depositAtMaturity(maturity, 1, 0, attacker)` and receives ~6.657 ether of unassigned earnings.
**How found:** Code reading of liquidation path: noticed canDiscount=false in noTransferRepayAtMaturity skips unassigned earnings, then reasoned that the next maturity depositor claims them; built Foundry PoC to confirm.
**Exploitation:** Attacker needs only 1 principal: borrow 1 at maturity to make floatingBackupBorrowed exceed supply, then deposit 1 at maturity to capture the entire unassigned liquidation fee.
**Insight:** When a liquidation path deliberately skips fee/earnings accounting, check who can become the next claimant of that skipped value and whether a minimal deposit/borrow can capture it.