<!-- canonical: https://0xsimao.com/findings/beraborrow-i-decrease-goes-below-debt -->

# `ManagedLeveragedVault::decreaseLeverage()` will not work when it goes below the minimum debt

Medium · Sherlock · CDP stablecoin · 25th April, 2025

Finding M-5 of the Beraborrow Managed Dens security review.

- Protocol: https://www.beraborrow.com/
- Report: /reports/beraborrow-i
- Source: https://1570492309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FffzDCMBDa391vIMqruBP%2Fuploads%2FUKDtjc6Dkn6P6i35j5H1%2FManaged%20Leverage%20Vaults%20v0%20private%20audit%20Sherlock.pdf?alt=media&token=c7304efa-8040-4ed0-9a98-dc949af28a85

---

## Summary

`ManagedLeveragedVault::decreaseLeverage()` is used to increase the ICR of the Den, but it may be DoSed in case it goes below the minimum debt limit.

## Vulnerability Detail

There is no consideration for the minimum debt in this function:
```solidity

function decreaseLeverage(
    uint256 _exposureAmount,
    address _upperHint,
    address _lowerHint,
    ExternalRebalanceParams memory params
) external onlyOwnerOrKeeper nonReentrant returns (uint256 debt) {
    BoycoVaultStorage storage b$ = _getBoycoVaultStorage();
    ManagedLeveragedVaultStorage storage $ = _getManagedLeveragedVaultStorage();

    debt = _rebalance(
        RebalanceParams({
            sentCurrency: $.exposureToken,
            sentAmount: _exposureAmount,
            receivedCurrency: address(b$.nect),
            ext: params
        })
    );

    b$.borrowerOperations.repayDebt(
        b$.denManager,
        address(this),
        debt,
        _upperHint,
        _lowerHint
    );

    _checkInvariantICR(getCurrentDenICR(), getTargetICR(), Tolerance.ABOVE);
}
```
And the last check forces the ICR to reach the target. Hence, it may not be possible to deleverage at all risking liquidation. It should be possible to deleverage the maximum possible until the minimum debt is reached.

## Impact

Liquidation/redemption risk.

## Code Snippet

https://github.com/sherlock-audit/2025-04-beraborrow-vault-update/pull/1/files#diff-2d972f52027e0ba1065b2de2b424416244bfef9e2a79d2604e1687867f72c91eR472

## Tool Used

Manual Review

## Recommendation

The target ICR requirement could be soften.

---

Related findings:

- [Withdrawing after a slash event before the vault has ended will decrease `fixedSidestETHOnStartCapacity` by less than it should, so following users will withdraw more their initial deposit](https://0xsimao.com/findings/saffron-lido-vaults-slash-eth-withdraw-deposit): Saffron Lido Vaults
- [`PreDepositVault::sweep()` uses `address.transfer` which does not work for certain wallets](https://0xsimao.com/findings/gaib-deposit-sweep-transfer-wallets): GAIB Pre-Vaults
- [`PreDepositVault` will not work for USDT](https://0xsimao.com/findings/gaib-pre-deposit-work-usdt): GAIB Pre-Vaults
- [BorrowingVault, if the debt/assets ratio falls too much, liquidators could choose to repay debt equal to the assets at a discount](https://0xsimao.com/findings/fuji-finance-debt-falls-choose-repay): Fuji Finance