Accountable — `AccountableOpenTerm` interest cannot be repaid once principal hits zero

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 62973-accountableopenterm-loan-interest-cannot-be-repaid-once-prin. Standalone Foundry PoC and full write-up: 62973-accountableopenterm-loan-interest-cannot-be-repaid-once-prin_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/logic/debt-accounting · fee-theft · debt-accrual-update

Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only forge-std — no fork, no RPC, no anvil_state. Full trace: output.txt. PoC: test/62973-accountableopenterm-loan-interest-cannot-be-repaid-once-prin_exp.sol.

AuditVault taxonomy: severity/high · sector/lending · sector/stable · platform/cyfrin · decimal-mismatch · fee-theft · debt-accrual-update · fee-accounting

Key info#

TL;DR#

1. Interest accrues virtually via _scaleFactor / scaleFactor.
2. repay() only reduces outstandingPrincipal; excess for interest is optional.
3. When principal reaches zero the loan flips to Repaid.
4. In Repaid, _requireLoanOngoing() blocks further supply/repay, and sharePrice falls back to assetShareRatio (ignores scale factor).
5. All accrued interest is permanently unpayable — LPs get 0 yield.

The vulnerable code#

if (assets >= outstandingPrincipal) {
    outstandingPrincipal = 0;
    loanState = LoanState.Repaid; // @> VULN: principal-zero → Repaid without requiring interest
    // FIX: burn debt shares at current scaleFactor; Repaid only when debtShares == 0
}

Root cause#

Liability is tracked as principal with a separate virtual scale factor, but the only funding paths reduce principal first. Hitting principal zero is treated as full repayment even when scale factor implies unpaid interest.

Preconditions#

• Open-term loan with positive interest rate; principal outstanding.
• Time passes so scaleFactor > PRECISION.
• Borrower repays exactly principal (maliciously or accidentally).

Attack walkthrough#

1. LP deposits USDC_AMOUNT; borrower draws full principal.
2. Accrue ~180 days of interest → scaleFactor > 1e36.
3. Borrower repays exactly principal → loanState = Repaid.
4. sharePrice returns 1:1 assetShareRatio (no interest realized).
5. Further supply(1) reverts via _requireLoanOngoing().

Diagrams#

Impact#

LPs systematically underpaid; a borrower can always avoid interest by repaying principal before realizing it. Unintentional last payments that exhaust principal have the same effect.

Sources#

• AuditVault finding #62973
• Cyfrin Accountable v2.0 report
• Reduced source: Accountable-Protocol AccountableOpenTerm — repay / _requireLoanOngoing / sharePrice (fixed in fce6961, 8e53eba)

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 62973-accountableopenterm-loan-interest-cannot-be-repaid-once-prin_exp (evm-hack-registry mirror).
• AuditVault finding: 62973-accountableopenterm-loan-interest-cannot-be-repaid-once-prin.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.