# Most `ManagedLeveragedVault` functions are DoSed due to bad debt check Low/Info · Sherlock · CDP stablecoin · 25th April, 2025 Finding L-9 of the Beraborrow Managed Dens security review. - Protocol: https://www.beraborrow.com/ - Report: /reports/beraborrow-i - Source: https://1570492309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FffzDCMBDa391vIMqruBP%2Fuploads%2FUKDtjc6Dkn6P6i35j5H1%2FManaged%20Leverage%20Vaults%20v0%20private%20audit%20Sherlock.pdf?alt=media&token=c7304efa-8040-4ed0-9a98-dc949af28a85 --- ## Summary Most `ManagedLeveragedVault` functions rely on `totalAssets()`, including ERC4626 compliant functions that must not revert; however, they will revert when there is bad debt. ## Vulnerability Detail `ManagedLeveragedVault:: _assetsValuation()` reverts when there is bad debt: ```solidity if (debtValue > collateralValue + exposureValue) { revert BadDebt(debtValue - (collateralValue + exposureValue)); } ``` This will make all ERC4626 functions revert that must not do so when called, becoming non compliant. Additionally, it is not possible to request withdrawal intents temporarily. ## Impact DoSed request intent and non ERC4626 compliance ## Code Snippet https://github.com/sherlock-audit/2025-04-beraborrow-vault-update/pull/1/files#diff-2d972f52027e0ba1065b2de2b424416244bfef9e2a79d2604e1687867f72c91eR985 ## Tool Used Manual Review ## Recommendation Handle the situation instead of reverting to allow the normal behaviour of the mentioned functions (although the behaviour may be hard to define). --- Related findings: - [Bad debt is never handled which places insolvency risks on BendDAO](https://0xsimao.com/findings/benddao-debt-places-insolvency-risks): BendDAO - [Some bad debt will not be cleared when it should which will cause accrual of bad debt decreasing the protocol's solvency](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-debt-cleared-accrual-solvency): Exactly Protocol Update - Staking Contract - [Liquidations will leave dust when repaying expired maturities, making it impossible to clear bad debt putting the protocol at a risk of insolvency](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-liquidations-dust-debt-insolvency): Exactly Protocol Update - Staking Contract - [Liquidator will leave a pool with unassigned earnings on `Market::clearBadDebt()` free to claim for anyone when the repaid maturity is not the last](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-liquidator-clear-debt-repaid): Exactly Protocol Update - Staking Contract