# Stale debt ignores accrued interest

Debt math using principal or cached totals instead of interest-inclusive value

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-07-17. Updated 2026-11-02._

## How it works
A protocol stores a principal-like number and derives the real debt by applying an interest or compounded factor at read time. The invariant is: every place that reads or mutates debt must use the interest-inclusive value. Bugs appear when one code path uses the raw stored principal (or a cached total) while the rest of the system uses the accrued value. The two views drift apart, and any ratio, fee, or collateral calculation built on the stale number is wrong.

## Where it shows up
- A stored field (e.g. `tokenTaken`, `point.amount`, `totalBorrowAssets`) that is mutated with raw `+=`/`-=` while debt is computed via a compounded factor elsewhere.
- Repay, withdraw, or liquidation math that reads a cached market total instead of accruing interest first.
- Partial-repayment paths that overwrite principal with principal+interest.
- Fee or unlock-price functions that divide by a compounded factor the mutation path ignores.

## How to review
Find every field that represents principal and every function that computes debt from it. The property to enforce: for any mutation of stored principal, the change must be expressed in the same units the debt formula expects (e.g. divide the amount by the compounded factor before subtracting). For integrations, confirm interest is accrued before any total is read. For lending contracts, confirm accrued interest is tracked separately from principal, or that folding it in matches the documented interest model. Compare each arithmetic site against the canonical debt formula; a single raw update is the tell.

## How finders spotted it
- Compared `adjustPosition()`'s `tokenTaken` arithmetic against the compounded-factor logic in `unlockPrice`/health, saw raw updates at L399/L413, then confirmed with a PoC that unlock price hit zero [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-11.md).
- Noticed `deriveLoanAmount` read cached `market.totalBorrowAssets` rather than accruing interest, then traced the repay-to-collateral ratio to show inflated withdrawable collateral [E2](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.1.md).
- Read `_payment` and saw `stack.point.amount` overwritten with `owed` (principal+interest) instead of tracking interest separately, then checked against the docs' simple-interest claim [E3](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-31.md).

## Variants seen
- Raw principal mutation over-crediting debt reduction, zeroing unlock fees [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-11.md).
- Cached market total understating debt, inflating withdrawable collateral [E2](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.1.md).
- Partial repayment folding interest into principal, compounding against documented simple interest [E3](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-31.md).

## Impact and severity
E1 let a user unlock a protected listing for free, bypassing fees [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-11.md). E2 let users withdraw inflated collateral and land near LLTV, risking liquidation [E2](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.1.md). E3 silently compounded interest, breaking documented behavior and overcharging borrowers [E3](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-31.md). Impact scales with how much value the stale number gates: fees, collateral limits, or interest owed.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-11.md
- E2: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.1.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-31.md