# Borrowers can brick the commitment group pool

Borrowers self-lending via TellerV2 can set a repayment listener on their own bid, inflating totalPrincipalTokensRepaid and underflowing the commitment group's outstanding-principal accounting, bricking the pool.

- Payout: Contest reward
- Severity: high
- Program: Teller
- Credited: 0x3b
- Disclosed: 2024-04-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/42
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-3
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:chained technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** LenderCommitmentGroup_Smart / TellerV2 repayment listener accounting
**Root cause:** setRepaymentListenerForBid only checks sender == bid.lender, so a borrower who is also the lender can register an arbitrary listener; on repayment the LCG callback increments totalPrincipalTokensRepaid and totalInterestCollected without a matching totalPrincipalTokensLended increase.
**Steps:**
1. Attacker acts as both borrower and lender, borrowing directly from TellerV2 (not through LCG) so totalPrincipalTokensLended is not incremented.
2. Call `setRepaymentListenerForBid(bidId, LCG)` as the lender to register the commitment group as repayment listener.
3. Repay the loan; `_repayLoan` -> `_sendOrEscrowFunds` invokes LCG `repayLoanCallback`, incrementing `totalPrincipalTokensRepaid` and `totalInterestCollected`.
4. Repeat, optionally with a custom infinite-liquidity token, to inflate repaid principal beyond lended principal.
5. `getTotalPrincipalTokensOutstandingInActiveLoans` underflows (lended - repaid), reverting and bricking the LCG; inflated interest also skews share value.
**How found:** Code review of the LCG borrow/repay accounting: noticed totalPrincipalTokensLended is only incremented in acceptFundsForAcceptBid while totalPrincipalTokensRepaid is incremented via the repayment listener callback, then checked whether a borrower could register that listener on a direct TellerV2 loan.
**Exploitation:** Attacker self-funds a direct TellerV2 loan, registers the LCG as repayment listener on their own bid, then repays. Each cycle credits the LCG's repaid/interest counters without corresponding lended principal, eventually underflowing outstanding-principal math and reverting pool operations; custom tokens with infinite liquidity amplify the skew.
**Escalation:** Repeating the borrow/repay cycle (or using attacker-controlled tokens) scales the accounting skew until the pool is permanently bricked and share pricing is distorted.
**Insight:** When a protocol pairs a 'lended' counter with a 'repaid' counter across two entry points, check whether the repayment path can be triggered for loans that never incremented the lended counter — e.g. by registering the callback on a self-originated loan.