# `ManagedLeveragedVault::getAvailableDebt()` used in `ManagedLeveragedVault::increaseLeverage()` is incorrect Low/Info · Sherlock · CDP stablecoin · 25th April, 2025 Finding L-5 of the Beraborrow Managed Dens security review. - Protocol: https://www.beraborrow.com/ - Report: /reports/beraborrow-i - Source: https://1570492309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FffzDCMBDa391vIMqruBP%2Fuploads%2FUKDtjc6Dkn6P6i35j5H1%2FManaged%20Leverage%20Vaults%20v0%20private%20audit%20Sherlock.pdf?alt=media&token=c7304efa-8040-4ed0-9a98-dc949af28a85 --- ## Summary `ManagedLeveragedVault::increaseLeverage()` allows borrowing until the `maxSystemDebt` limit, but the check doesn't account for the borrowing fee triggered. ## Vulnerability Detail This is the `ManagedLeveragedVault::getAvailableDebt()` function: ```solidity function getAvailableDebt() internal view returns (uint256) { BoycoVaultStorage storage b$ = _getBoycoVaultStorage(); IDenManager denManager = IDenManager(b$.denManager); uint256 borrowCap = denManager.maxSystemDebt(); uint256 totalActiveDebt = denManager.getTotalActiveDebt(); uint256 defaultedDebt = denManager.defaultedDebt(); return borrowCap - totalActiveDebt - defaultedDebt; } ``` It doesn't account for the borrowing fee triggered, which means the max debt will be overestimated. ## Impact This function would be used most likely offchain to calculate the max debt to leverage up, which would revert. ## Code Snippet https://github.com/sherlock-audit/2025-04-beraborrow-vault-update/pull/1/files#diff-2d972f52027e0ba1065b2de2b424416244bfef9e2a79d2604e1687867f72c91eR428 ## Tool Used Manual Review ## Recommendation This function should return the debt multiplied by (1 - borrowingFee). --- Related findings: - [Base calculation in `Leverager::isLiquidateable()` is incorrect as the max leverage may be smaller](https://0xsimao.com/findings/yieldoor-leverager-liquidateable-leverage-smaller): Yieldoor - [Destination Vault rewards are not added to idleIncrease when info.totalAssetsPulled > info.totalAssetsToPull](https://0xsimao.com/findings/tokemak-rewards-info-pulled-pull): Tokemak - [BorrowingVault, if the debt/assets ratio falls too much, liquidators could choose to repay debt equal to the assets at a discount](https://0xsimao.com/findings/fuji-finance-debt-falls-choose-repay): Fuji Finance - [Handling someone else repaying debt for the BorrowingVault could be done differently](https://0xsimao.com/findings/fuji-finance-handling-someone-debt-differently): Fuji Finance