# Borrowers can surpass `liquidityThresholdPercent` and borrow to near 100% of the principal

Borrowers deposit principal to inflate getPrincipalAmountAvailableToBorrow, borrow past liquidityThresholdPercent, then withdraw, locking LPs at ~100% utilization.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: 0x3b
- Disclosed: 2024-04-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/68
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-5
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** LenderCommitmentGroup_Smart lending pool contract
**Root cause:** getPrincipalAmountAvailableToBorrow computes the cap from getPoolTotalEstimatedValue, which includes totalPrincipalTokensCommitted; a borrower's own deposit inflates the cap, and nothing prevents withdrawing that deposit after borrowing.
**Steps:**
1. Set liquidityThresholdPercent=80%, pool value $100k, $80k already borrowed -> available = 0.
2. Alice deposits $25k principal -> pool value $125k, available = 125k*80% - 80k = $20k.
3. Alice calls acceptFundsForAcceptBid to borrow $20k (passes `getPrincipalAmountAvailableToBorrow() >= _principalAmount`).
4. Alice withdraws her $25k principal, leaving pool at ~100% utilization.
**How found:** Code reading of the borrow-limit check in acceptFundsForAcceptBid and noticing getPrincipalAmountAvailableToBorrow derives its cap from total committed principal, which the borrower controls via deposit/withdraw.
**Exploitation:** Attacker supplies principal (flash loan optional) to raise the estimated pool value, borrows the newly available amount up to the threshold, then withdraws the deposit, pushing utilization to ~100% and locking LPs.
**Insight:** When a utilization/borrow cap is computed from total pool value that includes user-supplied deposits, test whether depositing then withdrawing around the borrow lets you inflate the cap and bypass it.