# Repaying a Loan with Permit in UErc20.sol Wrongly calculates the interest to be paid this Reduce/Increase profits for the protocol as interest calculations are not performed correctly.

UErc20 repayBorrowWithERC20Permit passes unscaled interest to _repayBorrowFresh while amount is scaled to 1e18, miscomputing interest for non-18-decimal tokens like USDC.

- Payout: Contest reward
- Severity: high
- Program: Union Finance Update 2
- Credited: Bigsam
- Disclosed: 2024-06-12
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-union-finance-update-2-judging/issues/43
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-union-finance-update-2%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** UErc20.sol repayBorrowWithERC20Permit / _repayBorrowFresh
**Root cause:** repayBorrowWithERC20Permit calls calculatingInterest(borrower) which returns interest in underlying token decimals, but _repayBorrowFresh expects interest scaled to 1e18 like the amount; only the amount is passed through decimalScaling.
**Steps:**
1. Deploy market with underlying token of 6 decimals (USDC/USDT).
2. Borrower accrues interest; call repayBorrowWithERC20Permit(borrower, amount, deadline, v, r, s).
3. Observe interest = calculatingInterest(borrower) is in 1e6 units while amount is decimalScaling'd to 1e18.
4. _repayBorrowFresh records interest ~1e12x too small; excess remains unassigned in pool.
**How found:** Code reading comparing the permit repay path against the normal repay path in UToken.sol, noticing interest is scaled in one but not the other.
**Exploitation:** Any borrower repaying via permit path underpays interest on <18-decimal tokens; surplus funds stay stuck in contract, reducing lender/protocol profit.
**Insight:** When a contract has two entry points to the same internal repay/settle function, diff the argument scaling between them; permit/permit2 variants frequently skip the decimalScaling applied on the standard path.