<!-- canonical: https://0xsimao.com/findings/beraborrow-i-hints-withdrawal-collateral-debt -->

# Hints on withdrawal may fail as the ICR changes between claiming collateral surplus and repaying debt

Low/Info · Sherlock · CDP stablecoin · 25th April, 2025

Finding L-10 of the Beraborrow Managed Dens security review.

- Protocol: https://www.beraborrow.com/
- Report: /reports/beraborrow-i
- Source: https://1570492309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FffzDCMBDa391vIMqruBP%2Fuploads%2FUKDtjc6Dkn6P6i35j5H1%2FManaged%20Leverage%20Vaults%20v0%20private%20audit%20Sherlock.pdf?alt=media&token=c7304efa-8040-4ed0-9a98-dc949af28a85

---

## Summary

Insertion hints depend on the ICR of the Den, on withdrawals the same hints are used in 2 different instances, which may not work and revert.

## Vulnerability Detail

The `ManagedLeveragedVault::executeWithdrawalEpoch()` is as follows:
```solidity
function executeWithdrawalEpoch(
    ExecuteWithdrawalParams calldata params
) external onlyOwner nonReentrant claimCollateralSurplus(params.upperHint, params.lowerHint) {
    BoycoVaultStorage storage b$ = _getBoycoVaultStorage();

    _checkEpoch(params.epoch);

    CollDebt memory cd = _getCollVaultSharesAndDebtToUnwind(params.epoch);

    b$.borrowerOperations.adjustDen({
        denManager: b$.denManager,
        account: address(this),
        _maxFeePercentage: 0,
        _collDeposit: 0,
        _collWithdrawal: cd.collVaultSharesToWithdraw,
        _debtChange: cd.debtToUnwind,
        _isDebtIncrease: false,
        _upperHint: params.upperHint,
        _lowerHint: params.lowerHint
    });
```
It uses the same hints for 2 different intances, with different ICRs each time. Hence, there is a chance the transaction reverts.

## Impact

DoSed `ManagedLeveragedVault::executeWithdrawalEpoch()`. Workaround is possible by manually claiming collateral surplus before calling it.

## Code Snippet

https://github.com/sherlock-audit/2025-04-beraborrow-vault-update/blob/main/blockend/src/core/boyco/ManagedLeveragedVault.sol#L297-L314

## Tool Used

Manual Review

## Recommendation

Send different hints.

---

Related findings:

- [Claiming will fail for Ole and D1MemeToken if the overfunded ETH reverts](https://0xsimao.com/findings/districtone-meme-overfunded-eth-reverts): DistrictOne
- [Liquidations will leave dust when repaying expired maturities, making it impossible to clear bad debt putting the protocol at a risk of insolvency](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-liquidations-dust-debt-insolvency): Exactly Protocol Update - Staking Contract
- [Handling someone else repaying debt for the BorrowingVault could be done differently](https://0xsimao.com/findings/fuji-finance-handling-someone-debt-differently): Fuji Finance
- [StakingOperator::setCollateralToken() will cause issues if it changes tokens relations that have already been set](https://0xsimao.com/findings/singularity-staking-collateral-changes-relations): Singularity