# New debt from adjusted trove is double counted towards the limit Low/Info · Sherlock · CDP stablecoin · 3rd February, 2025 Finding L-1 of the Nerite security review. - Protocol: https://www.nerite.org/ - Report: /reports/nerite - Source: https://drive.google.com/file/d/1knlIgoEGv5x33n9mhTLRqJe8T55r3HCy/view --- ## Summary When adjusting a trove, the newly minted debt is counted twice, as `troveManager.getEntireSystemDebt()` already includes the new debt. ## Vulnerability Detail `BorrowerOperations::_moveTokensFromAdjustment()` checks if the debt has exceeded the limit by requiring that `troveManager.getDebtLimit() >= troveManager.getEntireSystemDebt() + _troveChange.debtIncrease`. However, when this check is performed, `troveManager.getEntireSystemDebt()` already includes the `_troveChange.debtIncrease` component, as it was added previously in the `vars.activePool.mintAggInterestAndAccountForTroveChange(_troveChange, batchManager);` call. ## Impact Adjusting troves will revert due to the debt limit when they should not. ## Code Snippet https://github.com/sherlock-audit/2025-02-nerite/blob/main/nerite/contracts/src/BorrowerOperations.sol#L670 https://github.com/sherlock-audit/2025-02-nerite/blob/main/nerite/contracts/src/BorrowerOperations.sol#L1227 https://github.com/sherlock-audit/2025-02-nerite/blob/main/nerite/contracts/src/ActivePool.sol#L164 https://github.com/sherlock-audit/2025-02-nerite/blob/main/nerite/contracts/src/ActivePool.sol#L233-L238 ## Tool Used Manual Review ## Recommendation `require(troveManager.getDebtLimit() >= troveManager.getEntireSystemDebt(), "BorrowerOperations: Debt limit exceeded.");` should be enough. --- Related findings: - [reduceOnly limit order update does not take into account that a new amm may be selected, which may lead to loss of funds](https://0xsimao.com/findings/nftperp-i-reduce-account-amm-selected): Nftperp Exchange - [Protocol will need to donate minimum debt for all new ManagedLeveragedVaults](https://0xsimao.com/findings/beraborrow-i-need-donate-debt-vaults): Beraborrow Managed Dens - [`ManagedLeveragedVault::increaseLeverage()` fails when the debt is closed to the limit](https://0xsimao.com/findings/beraborrow-i-leverage-fails-debt-closed): Beraborrow Managed Dens - [DoSed withdrawals due to `ManagedLeveragedVault::executeWithdrawalEpoch()` repaying debt above limit](https://0xsimao.com/findings/beraborrow-i-withdrawals-withdrawal-epoch-debt): Beraborrow Managed Dens