# Malicious borrower can pay each payment and make its own loan default 1 month later

Off-by-one in Teller's calculateNextDueDate lets a borrower repay just past a cycle boundary to double the next due date, halving effective APY.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: jovi
- Disclosed: 2024-04-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/116
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-8
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** V2Calculations.calculateNextDueDate in TellerV2 loan repayment logic
**Root cause:** calculateNextDueDate adds 2 payment cycles when lastRepaidTimestamp's day exceeds acceptedTimestamp's day, and uses ceilDiv(delta, paymentCycle) which rounds up to an extra cycle when repayment lands just past a cycle boundary.
**Steps:**
1. Set up a bid with acceptedTimestamp=100, paymentCycle=30 days, paymentCycleAmount=10.
2. Warp ~30 days + 1 hour past acceptedTimestamp.
3. Call `repayLoan(bidId, 100)` so lastRepaidTimestamp lands just past one cycle.
4. Call `calculateNextDueDate(bidId)`; observe it returns ~2 cycles ahead (7776100 vs 5184100 in POC) instead of 1.
5. Repeat each cycle to keep pushing due dates out, paying half as often as required.
**How found:** Code review of V2Calculations.calculateNextDueDate; noticed the day-comparison branch adds 2 cycles and the ceilDiv(delta, paymentCycle) rounds up, then wrote Foundry POCs warping time to just past a cycle boundary to confirm the doubled due date.
**Exploitation:** Borrower times partial repayments to land one second/day past the accepted timestamp or just past a payment cycle boundary, so the next due date is computed as two cycles out. Repeating this lets the borrower make monthly payments every two months, halving the effective borrow APY and avoiding default.
**Insight:** When auditing loan/vesting schedule math, test repayments at exact cycle boundaries ±1 second: ceilDiv-based cycle counters and day-granularity comparisons both round in the borrower's favor at the boundary.