# borrow() maliciously let others to enter market

Market.borrow() lacks a zero-assets check, so anyone can call borrow(0, receiver, victim) to force the victim into a market, exposing unintended collateral to liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Interest Rate Model
- Credited: KupiaSec
- Disclosed: 2024-04-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-interest-rate-model-judging/issues/76
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:liquidation

**Target:** Market.borrow() / Auditor.checkBorrow() in Solidity lending protocol
**Root cause:** borrow() calls spendAllowance(borrower, assets) and auditor.checkBorrow() without rejecting assets==0; spendAllowance passes trivially for zero, yet checkBorrow still sets the borrower's market bit.
**Steps:**
1. Identify Market.borrow(assets, receiver, borrower) which calls spendAllowance then auditor.checkBorrow(this, borrower).
2. Note checkBorrow sets accountMarkets[borrower] |= marketMask when bit unset, with no assets check.
3. Call `market.borrow(0, address(this), victim)` from any address with no allowance.
4. Observe auditor.accountMarkets(victim) now includes the market bit (POC testAnyoneEnterMarket passes).
**How found:** Code review of borrow() flow: noticed spendAllowance security check is bypassable when assets==0 while checkBorrow side-effect (market entry) still executes.
**Exploitation:** Attacker calls borrow(0, attacker, victim) to flip the victim's market-entered bit. If the victim holds LP/deposit assets in that market but never entered it, those assets now count as collateral; combined with an existing borrow allowance, attacker can borrow against collateral the victim never intended to pledge, or victim's assets become seizable on liquidation.
**Escalation:** Chained with prior borrow approval: attacker forces victim into a high-value market then borrows against it, effectively stealing via allowance.
**Insight:** When a function gates a state-changing side effect (market entry) behind a value-transfer/allowance check, test the zero-value path: zero amounts often pass allowance math but still trigger the side effect.