# Protocol will need to donate minimum debt for all new ManagedLeveragedVaults Medium · Sherlock · CDP stablecoin · 25th April, 2025 Finding M-6 of the Beraborrow Managed Dens security review. - Protocol: https://www.beraborrow.com/ - Report: /reports/beraborrow-i - Source: https://1570492309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FffzDCMBDa391vIMqruBP%2Fuploads%2FUKDtjc6Dkn6P6i35j5H1%2FManaged%20Leverage%20Vaults%20v0%20private%20audit%20Sherlock.pdf?alt=media&token=c7304efa-8040-4ed0-9a98-dc949af28a85 --- ## Summary `ManagedLeveragedVault::deposit()` doesn't allow depositing before the Den is opened, which means the only way to have a minimum collateral amount to open the minimum debt in `ManagedLeveragedVault::openDen()` is by donating assets. ## Vulnerability Detail See `ManagedLeveragedVault::deposit()`: ``` function deposit(uint256 assets, address receiver, AddCollParams calldata params) public notPaused nonReentrant returns (uint256 shares) { BoycoVaultStorage storage b$ = _getBoycoVaultStorage(); shares = _deposit(assets, receiver); IERC20(asset()).forceApprove(address(b$.collVault), assets); uint256 collVaultShares = b$.collVault.deposit(assets, address(this)); if (collVaultShares < params.minSharesOut) revert VaultSlippage(params.minSharesOut, collVaultShares); _addColl(collVaultShares, params.upperHint, params.lowerHint); } ``` It tries to add collateral, but it reverts before the Den is opened. As opening a Den requires minimum debt (and thus minimum collateral), the only way to have assets when opening is by donating. ## Impact Protocol needs to donate min debt, and can't recover these funds. ## Code Snippet https://github.com/sherlock-audit/2025-04-beraborrow-vault-update/pull/1/files#diff-2d972f52027e0ba1065b2de2b424416244bfef9e2a79d2604e1687867f72c91eR507 ## Tool Used Manual Review ## Recommendation Let users deposit before the Den is opened (just let the funds idle instead of adding collateral). --- Related findings: - [Anyone will DoS setting a new rewards duration which harms the protocol/users as they will receive too much or too little rewards](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-rewards-duration-harms-little): Exactly Protocol Update - Staking Contract - [New debt from adjusted trove is double counted towards the limit](https://0xsimao.com/findings/nerite-debt-adjusted-counted-towards): Nerite - [Some bad debt will not be cleared when it should which will cause accrual of bad debt decreasing the protocol's solvency](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-debt-cleared-accrual-solvency): Exactly Protocol Update - Staking Contract - [Liquidations will leave dust when repaying expired maturities, making it impossible to clear bad debt putting the protocol at a risk of insolvency](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-liquidations-dust-debt-insolvency): Exactly Protocol Update - Staking Contract