# `ManagedLeveragedVault::increaseLeverage()` fails when the debt is closed to the limit Medium · Sherlock · CDP stablecoin · 25th April, 2025 Finding M-4 of the Beraborrow Managed Dens security review. - Protocol: https://www.beraborrow.com/ - Report: /reports/beraborrow-i - Source: https://1570492309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FffzDCMBDa391vIMqruBP%2Fuploads%2FUKDtjc6Dkn6P6i35j5H1%2FManaged%20Leverage%20Vaults%20v0%20private%20audit%20Sherlock.pdf?alt=media&token=c7304efa-8040-4ed0-9a98-dc949af28a85 --- ## Summary `ManagedLeveragedVault::increaseLeverage()` will revert when the protocol is close to the max debt as it needs to borrow more than the debt allows in order for the ICR to reach the target. ## Vulnerability Detail `ManagedLeveragedVault::increaseLeverage()` check is too strict requiring that the final ICR is very close to the target: ```solidity _checkInvariantICR(getCurrentDenICR(), getTargetICR(), Tolerance.ABOVE); ``` Thus, it will not be possible to increase the leverage, even if this change would bring it closed to the target ICR. ## Impact Smaller leverage than intended. ## Code Snippet https://github.com/sherlock-audit/2025-04-beraborrow-vault-update/pull/1/files#diff-2d972f52027e0ba1065b2de2b424416244bfef9e2a79d2604e1687867f72c91eR449 ## Tool Used Manual Review ## Recommendation Allow the ICR to be higher than the target as long as it is above it. --- Related findings: - [New debt from adjusted trove is double counted towards the limit](https://0xsimao.com/findings/nerite-debt-adjusted-counted-towards): Nerite - [Destination Vault rewards are not added to idleIncrease when info.totalAssetsPulled > info.totalAssetsToPull](https://0xsimao.com/findings/tokemak-rewards-info-pulled-pull): Tokemak - [`PreDepositVault::maxDeposit/Mint()` are missing `maxDepositLimit` as per the ERC4626 spec](https://0xsimao.com/findings/gaib-deposit-mint-erc4626-spec): GAIB Pre-Vaults - [DoSed liquidations as `PrizeVault::liquidatableBalanceOf()` does not take into account the `mintLimit` when the token out is the asset](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-liquidations-prize-liquidatable-mint): PoolTogether Prize Layer