# Utilization rates are 0 when average assets are 0, which may be used to game maturity borrows / deposits / withdrawals

Interest Rate Model returns 0 utilization when average floating assets are 0, letting the first depositor borrow at the lowest rate and steal lender fees.

- Payout: Contest reward
- Severity: medium
- Program: Interest Rate Model
- Credited: 0x73696d616f
- Disclosed: 2024-04-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-interest-rate-model-judging/issues/150
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation vuln:reward-distribution

**Target:** Market.sol interest rate / utilization calculation
**Root cause:** globalUtilization/floatingUtilization return 0 when assets==0 instead of treating 0/0 as maximum utilization; previewFloatingAssetsAverage() stays 0 in the same block as the first deposit because averageFactor=1-e^0=0.
**Steps:**
1. Deploy a fresh market; lastAverageUpdate == block.timestamp and floatingAssetsAverage == 0.
2. As first depositor call `market.deposit(10_000 ether, ALICE)`; `previewFloatingAssetsAverage()` still returns 0.
3. In the same block call `market.borrowAtMaturity(maturity, assets/2, type(uint256).max, ALICE, ALICE)`.
4. Utilization computes as 0 (assets==0 branch), so the fixed rate is the minimum; compare assetsOwed vs a market where average assets equals deposits.
**How found:** Code reading of previewFloatingAssetsAverage and the utilization helpers: noticed averageFactor = 1 - e^(dampSpeed*(now-lastAverageUpdate)) is 0 when now==lastAverageUpdate, and that globalUtilization/floatingUtilization hardcode 0 when assets==0, so 0/0 favors borrowers.
**Exploitation:** First depositor deposits and immediately takes a fixed-rate borrow in the same block; because average floating assets are 0, utilization is 0 and the loan is priced at the lowest interest rate. Fees that should accrue to lenders are underpaid/unassigned and later converted to floating assets, effectively stealing yield.
**Insight:** In lending/IRM code, audit the assets==0 branch of utilization math: 0/0 should resolve to max utilization, not 0, and time-weighted averages initialized to block.timestamp make the first depositor's same-block borrow see a zero average.