highLogic errorEVM-Solidity
LEND: Incorrect Debt Tracking in `_updateRepaymentState`
- Payout
- $0
- Protocol
- LEND
- Disclosed
- Jun 3, 2025
- Source
- sherlock
LEND's CrossChainRouter._updateRepaymentState has an off-by-one state-corruption bug: it evaluates userCrossChainCollaterals.length after calling removeCrossChainCollateral, which mutates that same array. When a borrower fully repays their only debt, the lengt …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.