# Theft of unassigned earnings from a fixed pool

Dust borrows from a fixed pool round the fee to zero; repaying early yields a discount that drains unassigned earnings.

- Payout: Contest reward
- Severity: medium
- Program: Interest Rate Model
- Credited: ether_sky
- Disclosed: 2024-04-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-interest-rate-model-judging/issues/68
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:precision-loss vuln:reward-distribution

**Target:** Market.sol fixed-rate borrow/repay
**Root cause:** Fee uses mulWadDown rounding to zero on dust borrows; early-repay discount draws from unassigned earnings.
**Steps:**
1. Deposit collateral; call `borrowAtMaturity(maturity,190,max,max)` ~20,000x so each fee rounds to 0
2. Accumulate ~0.038e8 WBTC principal with fee==0
3. Call `repayAtMaturity(maturity,max,max,attacker)` early
4. Repay 0.03786283e8 < principal 0.038e8; delta from pool unassigned earnings
**How found:** Noticed mulWadDown fee rounds to zero for small assets at Market.sol#L320; reasoned early-repay discount tied to unassigned earnings turns zero-fee loan into sub-principal repayment.
**Exploitation:** Requires floatingBackupBorrowed>0 and cheap L2 gas; loop dust borrows to build zero-fee loan, repay early for discount funded by unassigned earnings.
**Insight:** Test whether splitting a position into dust-sized ops rounds every fee to zero via mulWadDown; then check if early-exit discounts are funded from pooled earnings, converting rounding into theft.