# liquidateDefaultedLoanWithIncentive can be gamed to avoid paying loans interest

LenderCommitmentGroup liquidation calls getAmountOwedForBid with includeInterest=false, letting liquidators repay only principal and skip accrued interest, spreading bad debt to the pool.

- Payout: Contest reward
- Severity: high
- Program: Teller
- Credited: 0xDjango
- Disclosed: 2024-04-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/121
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** LenderCommitmentGroup_Smart.sol liquidateDefaultedLoanWithIncentive
**Root cause:** liquidateDefaultedLoanWithIncentive computes amountDue via getAmountOwedForBid(_bidId, false), which returns only principal and omits accrued interest, unlike TellerV2's _liquidateLoanFull which repays principal plus interest.
**Steps:**
1. Borrow via a LenderCommitmentGroup so interest accrues.
2. Let the loan default.
3. Call `liquidateDefaultedLoanWithIncentive(_bidId, _tokenAmountDifference)` on LenderCommitmentGroup_Smart.
4. Observe amountDue = getAmountOwedForBid(_bidId, false) excludes interest; liquidator repays only principal.
5. Compare with TellerV2 `_liquidateLoanFull` which repays owedPrincipal + interest.
**How found:** Code reading comparing the boolean argument passed to getAmountOwedForBid in the group liquidation path against TellerV2's _liquidateLoanFull, which repays principal plus interest.
**Exploitation:** Liquidator chooses the LenderCommitmentGroup liquidation path instead of TellerV2, repaying only principal; unpaid interest becomes bad debt socialized across the lending pool while the liquidator benefits from the incentive.
**Insight:** When a protocol has two liquidation entry points, diff the debt-accounting arguments (e.g. includeInterest flags) between them; a mismatched boolean silently shifts interest loss onto the pool.