# Drained lender due to `LenderCommitmentGroup_Smart::acceptFundsForAcceptBid()` `_collateralAmount` by `STANDARD_EXPANSION_FACTOR` multiplication

Teller's LenderCommitmentGroup_Smart multiplied collateral by 1e18, letting borrowers take 10k DAI loans with 4 wei of WETH collateral.

- Payout: Contest reward
- Severity: high
- Program: Teller
- Credited: 0x3b
- Disclosed: 2024-04-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/58
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** LenderCommitmentGroup_Smart smart contract (Uniswap V3 price oracle)
**Root cause:** getCollateralRequiredForPrincipalAmount returns a price ratio already normalized by UNISWAP_EXPANSION_FACTOR (2**96), but acceptFundsForAcceptBid compares it against _collateralAmount * STANDARD_EXPANSION_FACTOR (1e18), so the required collateral is effectively 1e18 times too small.
**Steps:**
1. Deploy/fork Teller V2 with LenderCommitmentGroup_Smart initialized for DAI/WETH market.
2. Attacker calls `addPrincipalToCommitmentGroup(10_000e18, attacker)` with 10_000e18 DAI to become a lender.
3. Attacker calls `tellerV2.approveMarketForwarder(marketId, smartCommitmentForwarder)`.
4. Attacker calls `smartCommitmentForwarder.acceptCommitmentWithRecipient(lender, 10_000e18, 4, 0, WETH, attacker, 0, 2 days)` supplying only 4 wei WETH as collateral.
5. Loan is accepted because `4 * 1e18 >= requiredCollateral` where requiredCollateral is ~4e18/price, allowing full principal borrow.
**How found:** Researcher traced the Uniswap sqrtPriceX96 math: _getPriceFromSqrtX96 leaves a 2**96 factor that token0ToToken1/token1ToToken0 cancel via UNISWAP_EXPANSION_FACTOR, so getCollateralRequiredForPrincipalAmount returns a raw ratio; noticed acceptFundsForAcceptBid then multiplies collateral by STANDARD_EXPANSION_FACTOR (1e18), creating a 1e18 mismatch.
**Exploitation:** Attacker supplies a dust amount of collateral (4 wei WETH) to borrow the entire 10_000e18 DAI principal from the commitment group, then defaults; the lender's funds are drained because liquidation cannot recover value from negligible collateral.
**Insight:** When a protocol mixes multiple fixed-point scaling constants (Uniswap X96 vs 1e18), audit every comparison site for unit consistency; a single leftover expansion factor can invert collateral requirements.