# Interest rate in `LenderCommitmentGroup_Smart` may be easily manipulated by depositing, taking a loan and withdrawing

Teller LenderCommitmentGroup_Smart derives interest from spot utilization, so a borrower can deposit, borrow at a lower rate, then withdraw the deposit.

- Payout: Contest reward
- Severity: high
- Program: Teller
- Credited: 0x3b
- Disclosed: 2024-04-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/110
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-8
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** LenderCommitmentGroup_Smart lending pool contract
**Root cause:** Interest rate is computed from the instantaneous utilization ratio (outstanding loans / pool estimated value) with no time-weighting or withdrawal delay, so a deposit temporarily inflates the denominator and lowers the rate.
**Steps:**
1. Attacker calls `addPrincipalToCommitmentGroup(500e18, attacker)` to inflate `totalPrincipalTokensCommitted` and drop `getMinInterestRate()` from 400 to 266.
2. Attacker approves the market forwarder and calls `acceptCommitmentWithRecipient(lender, loanAmount, collateralAmount, 0, WETH, attacker, lender.getMinInterestRate(), 2 days)` to borrow at the reduced rate.
3. Attacker calls `burnSharesToWithdrawEarnings(shares, attacker)` to pull the deposited principal back out, leaving the loan outstanding at the low rate.
4. Result: `getPrincipalAmountAvailableToBorrow() == 0` while the attacker holds a cheap loan.
**How found:** Code review of `getPoolUtilizationRatio()` showed the rate depends only on current outstanding loans vs pool value with no constraint on deposit/borrow/withdraw ordering across periods, suggesting a sandwich.
**Exploitation:** Borrower flash-deposits principal to depress the utilization-derived interest rate, opens the loan at that rate, then immediately withdraws the deposit shares, capturing a lower interest rate at no capital cost and reducing LP yield.
**Escalation:** Same deposit/withdraw sandwich pattern also enables extracting interest from `totalInterestCollected` and avoiding liquidation losses via `tokenDifferenceFromLiquidations`.
**Insight:** When a rate or price is derived from a spot ratio of pool state, check whether an actor can move the denominator with a same-block deposit and unwind after the state-dependent action (borrow/repay/liquidate).