# Manipulation of the floating debt by updating `floatingBackupBorrowed`

Attacker inflates floatingBackupBorrowed via withdrawAtMaturity without accruing floating debt, manipulating utilization and stealing funds from borrowers.

- Payout: Contest reward
- Severity: medium
- Program: Interest Rate Model
- Credited: 0x73696d616f
- Disclosed: 2024-04-06
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-04-interest-rate-model-judging/issues/72
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** Market contract (fixed-rate pool functions)
**Root cause:** Functions updating floatingBackupBorrowed (withdrawAtMaturity, repayAtMaturity, depositAtMaturity) do not accrue floating debt first, so utilization rate changes retroactively alter accrued debt.
**Steps:**
1. Deposit floating liquidity into Market and enter market.
2. Wait 2 weeks, then simulate users borrowing at fixed and floating rates.
3. Deposit fixed liquidity via `depositAtMaturity`.
4. Warp to near maturity, call `withdrawAtMaturity` to inflate `floatingBackupBorrowed` without accruing floating debt.
5. Observe increased floating debt and profit from inflated redeem value.
**How found:** Code review noticed that floatingBackupBorrowed updates in fixed-pool functions lack prior floating debt accrual, unlike other functions.
**Exploitation:** Attacker deposits into floating pool, then provides fixed liquidity and withdraws early via withdrawAtMaturity, inflating floatingBackupBorrowed and causing borrowers to owe more, profiting lenders (attacker) at borrowers' expense.
**Escalation:** Inflation can push borrowers underwater, triggering liquidations.
**Insight:** When a state variable affects interest calculations, ensure it is updated only after accruing pending interest to prevent retroactive manipulation.