# Malicious user can call `borrowing::calculateCumulativeRate()` any number of times to inflate debt rate as `lastEventTime` is not updated Crit/High · Sherlock · Hedged stablecoin · 4th December 2024 Finding H-21 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/778 --- ### Summary [borrowing::calculateCumulativeRate()](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/borrowing.sol#L530) does not update `lastEventTime`, so the cumulative rate may be increased unbounded, forcing users to repay much more debt. ### Root Cause In `borrowing::calculateCumulativeRate()`, `lastEventTime` is not updated. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. Users deposit cds. 2. Users borrow. 3. Malicious user calls `borrowing::calculateCumulativeRate()` any number of times. 4. Borrowers have to repay much more debt. ### Impact Borrowers take massive losses as they have to repay much more. ### PoC See links above. ### Mitigation Update `lastEventTime`. --- Related findings: - [Unconditional lastUpdated advance in RangePool.sync leads to loss of streamed BMX when pool liquidity == 0](https://0xsimao.com/findings/bmx-unconditional-range-streamed-bmx): BMX - [In ConnextHandler, executeFailedWithUpdatedArgs(...), the whole tx is updated on storage if the try call succeeds](https://0xsimao.com/findings/fuji-finance-whole-storage-try-succeeds): Fuji Finance - [`ReserveLogic::_updateIndexes()` assumes the utilization rate was constant the whole time when calculating the new borrows](https://0xsimao.com/findings/yieldoor-constant-whole-calculating-borrows): Yieldoor - [`rewardData.releaseRate` is incorrectly calculated on `RewardsController::config()` when `block.timestamp > start` and `rewardData.lastConfig != rewardData.start`](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-reward-release-rewards-timestamp): Exactly Protocol Update - Staking Contract