Cowrie Research

utilization-boundary-failure

15 min read

Utilization-Boundary Failure / Off-Ledger Liquidity Interest Explosion

  • Also called in some academic literature: utilization kink attack

  • Name: Utilization-boundary failure / off-ledger liquidity interest explosion

  • Category: exploit pattern / lending-accounting failure / donation-driven interest manipulation / collateral inflation

  • Summary: This exploit family appears when a lending market decides how much can be borrowed from live token balances but decides what utilization and interest should be from a narrower internal deposits ledger. Direct token transfers or donations create borrowable liquidity that the protocol did not count as deposits. Once an attacker borrows that off-ledger liquidity, totalBorrowAmount can exceed totalDeposits. If the interest model, collateral accounting, or depositor-share math behaves dangerously above 100% utilization, the protocol can print depositor value and turn a dust position into borrowable solvency. The academic framing utilization kink attack is useful when the decisive profit engine is the rate curve’s sharp post-kink behavior rather than the donation step by itself.

  • What it is:

    • The protocol tracks deposits in storage such as totalDeposits, but borrowable liquidity is derived from raw token balance or another broader balance metric.
    • Anyone can transfer underlying tokens directly to the market without going through deposit().
    • Those donated tokens increase borrowable liquidity but do not mint deposit shares or raise totalDeposits.
    • An attacker then borrows the donated liquidity so the market’s debt exceeds the deposits book that the interest model assumes is the denominator.
    • The protocol next accrues interest or reprices collateral using a utilization ratio that is greater than 100%, often in a region the model was never meant to reach.
    • If depositors or collateral holders are credited that inflated interest immediately, the attacker can borrow real assets against accounting that only exists because balance and booked deposits diverged.

  • Typical preconditions:

    • The market accepts direct ERC-20 transfers that change borrowable liquidity without updating the deposits ledger.
    • Borrow capacity is checked against balanceOf(address(this)), liquidity(), or similar live-balance reads rather than only against booked deposits.
    • Utilization is computed as something like totalBorrowAmount / totalDeposits.
    • The interest curve, collateral valuation, or depositor accounting becomes unsafe, discontinuous, or merely very steep once utilization exceeds 100%.
    • The attacker can control both the dust supplier position and the account that borrows the donated liquidity, often across two addresses.
    • The market is empty or thin enough that one actor can cheaply become the dominant depositor before triggering the mismatch.

  • Common vulnerable surfaces:

    • isolated lending markets whose deposit() bookkeeping and liquidity() calculation depend on different state sources
    • money markets that treat unsolicited token transfers as usable reserves
    • interest-rate models with exponential or supercritical behavior above their intended utilization domain
    • collateral systems that immediately capitalize accrued interest into deposit value or borrow power
    • fresh or dormant markets where one attacker can own almost all meaningful deposit shares

  • Exploit sequence:

    1. The attacker identifies a market with zero or near-zero booked deposits for the target asset.
    2. They deposit a dust amount of that asset through the official path so they own nearly all deposit-share state.
    3. They transfer or donate additional underlying directly to the market contract, increasing raw borrowable liquidity without increasing totalDeposits.
    4. A second controlled account posts some other collateral and borrows the donated asset.
    5. The next interest-accrual step observes totalBorrowAmount > totalDeposits, so utilization exceeds 100%.
    6. The market credits extreme interest to depositors or otherwise reprices the first account’s position upward.
    7. The attacker uses that printed collateral to borrow stronger assets elsewhere in the same market stack, leaving bad debt once the accounting normalizes.

  • Variants:

    • Zero-deposit bootstrap — the cleanest version: the attacker targets an asset whose booked deposits are exactly zero, deposits dust, then borrows against a donated balance.
    • Dust-majority depositor capture — even when the market is not completely empty, the attacker first concentrates most deposit shares so any later interest explosion credits them almost entirely.
    • Supercritical interest-model blow-up — the exploit depends mainly on the interest curve becoming absurd above 100% utilization.
    • Utilization-kink attack — the interest model has an especially steep region once utilization crosses its designed ceiling, so any path that lets borrow > deposits turns the rate curve itself into the value-printing primitive.
    • Collateral-capitalization variant — instead of withdrawing the attacked asset itself, the attacker uses the inflated depositor position as collateral to borrow other assets.
    • Whitehat near miss — some protocols catch the bug before theft, but the mechanism is still important because the same state split can recur in other lending designs.

Three reserve-state promotions reviewers should not collapse

  1. Some live balance exists that a borrow path can see

    • Tokens have reached the market contract through donation, direct transfer, bridge mint, fee drip, or some other off-path balance change.
    • This is only a raw inventory fact. It is weaker than these tokens are booked deposits, and much weaker than these tokens now safely support borrowing and collateral repricing.

  2. That visible balance is still treated as canonical reserve truth for utilization and depositor economics

    • The dangerous promotion happens when borrow logic, utilization math, or reserve helpers silently treat the broader live balance as if it were the same object as totalDeposits.
    • Reviewers should ask exactly where the protocol upgrades tokens are present into these tokens belong inside the denominator that decides utilization, depositor yield, and reserve health.

  3. That accepted reserve truth still deserves monetary authority elsewhere in the system

    • Even after a protocol has recognized some reserve state, it still should not automatically mean that supercritical interest, paper depositor gains, or freshly distorted share value can become immediate collateral truth.
    • This is the decisive promotion: once the rest of the lending stack is willing to lend against the printed value, an internal reserve-accounting split becomes a systemwide solvency problem.
  • Detection heuristics:
    • Compare every liquidity source with every deposits ledger source. Ask whether borrowable balance can ever exceed booked deposits through direct transfers, fee flows, or donations.
    • Prove or test that utilization-sensitive code remains safe when utilization is above 100%, or better, prove that such states cannot arise.
    • Fork a live empty market, transfer underlying directly to the contract, and see whether another account can borrow against that balance without minting new deposit shares.
    • Stress-test interest accrual, depositor-share pricing, and collateral checks after same-asset donation-and-borrow sequences.
    • Treat donation paths as solvency-critical accounting, not as harmless excess reserves.
  • Defenses:
    • Do not let unsolicited underlying balances automatically become borrowable liquidity unless the deposits ledger is updated in lockstep.
    • Cap or sanitize utilization fed into interest models, and explicitly define safe behavior when the protocol somehow observes utilization > 100%.
    • Add invariants that totalBorrowAmount <= totalDeposits or otherwise prove why the broader design can safely violate that relation.
    • Pair the ledger invariant with a rate-bound invariant: if utilization somehow still exceeds its intended domain, the interest model should remain bounded and non-exploitable rather than becoming a value-printing machine.
    • Quarantine empty markets, seed them with non-burnable supply, or keep borrowing disabled until meaningful deposits exist.
    • Account for direct transfers explicitly: sweep them into a controlled reserve bucket, ignore them for borrowing, or mint non-user-owned shares against them.
    • Test cross-account attack bundles where one address manufactures the mismatch and another monetizes the printed collateral.

What sound design looks like

  • One reserve truth feeds borrowing and pricing

    • The market should be able to point to one reconciled state object for borrowable liquidity, booked deposits, and utilization inputs rather than mixing raw balance reads with narrower internal ledgers.
    • The sharpest reserve-local companion here is borrowable-liquidity and deposit-ledger coherence discipline: the market should not let one ledger answer how much may be borrowed? while a narrower ledger still answers what denominator prices utilization and depositor economics?
    • The adjacent path-parity companion is helper-path invariant reuse and fail-closed discipline: reserve helpers, rescue paths, and liquidity readers should all preserve the same balance-sheet boundary instead of silently widening it for one path and narrowing it for another.

  • Unsolicited balances fail closed by default

    • Direct transfers, bridge mints, fee drips, rebases, and rescue top-ups should land in an explicitly non-user-owned bucket unless a controlled reconciliation step says otherwise.
    • A healthy market should not let tokens arrived at the contract automatically mean someone may now borrow them.
    • The broader ambient-inventory design companion is unexpected-balance quarantine and explicit recognition discipline: raw balance is not yet recognized reserve truth just because a borrow path can see it.

  • Out-of-domain utilization is bounded and non-monetizable

    • If the protocol ever still reaches utilization > 100%, that state should degrade toward pause, clamped accrual, or reserve quarantine rather than toward explosive depositor yield and new collateral capacity.
    • Interest-model domain assumptions should be enforced twice: once at the ledger boundary that is supposed to keep utilization inside range, and again at the rate / collateral layer that would otherwise turn a broken assumption into printable value.

  • Thin-market states stay quarantined

    • Empty or dust-dominated markets should not be allowed to publish full collateral truth just because their local math returns a number.
    • The adjacent positive-design companion is collateral-admission lag and borrow-side quarantine: a market can be locally live before it is trusted system-wide to support borrowing against attacker-ownable supplier state.

  • Accrued interest and collateral truth remain distinct security states

    • Even if the protocol recognizes some accrued interest internally, that should not mean the dominant depositor can instantly pledge the entire paper gain as money-good collateral before any real repayment or reserve growth occurs.
    • The adjacent positive-design companion is reward-recognition, presentation, and collateral-admission separation: the rate model says depositors earned more should often be weaker than the lending system may lend against that value right now.

  • Recovery and recapitalization are explicit, not ambient

    • If a market becomes thin, damaged, or donation-distorted, operators should recover it through an explicit reserve or recapitalization path rather than by letting the next donation or borrow cycle redefine depositor economics.
    • The nearby recovery-side companion is low-supply recovery and recapitalization discipline: production systems that revisit dust-liquidity states need a named repair object, not ordinary user flow pretending to be a restart.

Failure-prevention checklist

  • Pick one canonical truth for borrowable liquidity, deposit denominator, and utilization inputs, then force every borrow, accrual, and collateral path to read from that same reconciled state object.
  • Decide explicitly what direct transfers, rescue flows, rebases, fee drips, and accidental donations mean. If the answer is not new depositor-owned liquidity, do not let those balances become borrowable by default.
  • Encode a hard invariant for the intended model domain: if the design assumes totalBorrowAmount <= totalDeposits, either prove it everywhere or make the out-of-domain state non-monetizable.
  • Bound utilization-sensitive math twice: clamp or safely extend the utilization input, and separately cap the interest, collateral repricing, or share-value output that could be minted from it.
  • Keep empty and dust markets in quarantine. A market where one actor can own nearly all deposit shares should not also let that actor manufacture the utilization regime for everyone else.
  • Treat accrued-but-unrealized interest as dangerous collateral input. If a rate spike can instantly reprice depositor collateral before any real repayment happens, the protocol is capitalizing hypothetical yield into borrow power.
  • Test multi-account, multi-block attack bundles, not just single-call reentrancy-style traces. This family often needs one address to manufacture the mismatch and another to harvest it one block later.
  • Monitor for production-impossible states: borrow > deposits, utilization above the documented ceiling, abrupt depositor APR explosions, or empty markets suddenly becoming heavily borrowed.
  • When using formal verification or bounded proofs, prove the assumptions too. Utilization is always <= 100% is not a harmless simplification if direct transfers can invalidate it.

Audit prompts

  • What exact variable defines available to borrow, and what exact variable defines the denominator for utilization and depositor interest accrual? Are they guaranteed to move together?
  • If someone transfers underlying directly to the market without calling deposit(), what changes: raw balance, borrowable liquidity, deposit shares, utilization denominator, reserve bucket, or nothing?
  • Can one account donate or park liquidity while another account borrows it, so the exploit path is hidden across identities rather than inside one user flow?
  • Does the protocol intentionally tolerate utilization > 100% in any state? If yes, what keeps the rate model, collateral engine, and depositor accounting bounded and non-extractive there?
  • Can accrued interest that has not actually been repaid still increase collateral value, LTV headroom, share price, or withdrawal power for the dominant depositor?
  • How does the market behave in zero-deposit, near-zero-deposit, and majority-dust-holder states? Are borrowing and collateral admission still enabled there?
  • Are direct transfers, fee sweeps, bridge mints, rescued funds, or rebasing balance changes reconciled before liquidity() or equivalent borrow checks trust them?
  • What invariant or monitor would fire first if borrowable balance and booked deposits diverged in production?
  • If the utilization model has a kink, exponential tail, or fallback branch above its intended ceiling, has anyone proven that region is unreachable or economically harmless?
  • Can one manipulated market print collateral that is then used to drain stronger sibling assets before operators can challenge the accounting?

Lessons that should already be standard

  • Live token balance and the deposits ledger are not interchangeable truths. If one decides borrowing power and the other decides interest, the gap between them is already a solvency surface.

  • Utilization > 100% should be treated like an emergency state, not an exotic corner for the interest model to improvise through.

  • Empty-market conditions turn rate math into governance over value distribution. If one dust depositor can own nearly all shares, any later interest explosion belongs to the attacker by construction.

  • Unsolicited transfers are not free liquidity. They are adversarial inputs unless the protocol has explicitly reconciled them into a reserve, treasury, or non-user-owned bucket.

  • Interest-rate models need domain discipline. A beautiful curve inside 0-100% utilization is not enough if off-path state splits can push execution into a supercritical branch.

  • Capitalizing unrealized interest directly into collateral value is a force multiplier. Once rate math is attacker-authored, the protocol is lending against hypothetical yield instead of settled assets.

  • Two-block and two-account exploit paths are still first-class exploits. Security review that only thinks in single-transaction bundles will miss this family.

  • Verification assumptions are part of the threat model. If a proof says we assume utilization never exceeds 100%, reviewers should immediately ask what enforces that assumption on raw balances.

  • High-signal incidents:

Internal linkages

  • Best concrete case study: silo-finance-weth-donated-liquidity-utilization-inflation-near-miss-2023-04-28.
  • Broader policy-to-state family: entrypoint-only-policy-off-path-state-mutation — use this when the sharper question is not specifically why did utilization explode above 100%? but why did the protocol guard one deposit path while a wider trusted liquidity state could still move underneath it.
  • Adjacent pattern: donation-share-price-manipulation — both families weaponize a direct transfer or donation into collateral inflation, but vault-share attacks manipulate exchange rate while this family manipulates lending utilization and accrued interest.
  • Adjacent pattern: supplier-index-inflation — both can turn a dust depositor position into large borrow power, but supplier-index inflation flows through rebasing index math whereas this family flows through utilization > 100% and unsafe interest accrual.
  • Adjacent pattern: solvency-check-bypass — both emerge from balance-sheet state splits, but here the decisive gap is between live liquidity and the deposits book feeding the interest model.
  • Positive-design companion on borrow/deposit ledger coherence: borrowable-liquidity-and-deposit-ledger-coherence-discipline — useful when the sharper question is how a lending market should keep borrowable liquidity, the deposits denominator, utilization math, and collateral publication on one coherent reserve story instead of letting another account borrow inventory that the depositor book never adopted.
  • Positive-design companion on utilization-domain containment: utilization-domain-enforcement-and-supercritical-rate-quarantine — useful when the sharper question is what should happen once the impossible state already appears: whether the rate model should clamp, quarantine, treasury-route, or otherwise weaken supercritical-rate output before it can become depositor value or collateral truth.
  • Positive-design companion on reserve-path consistency: helper-path-invariant-reuse-and-fail-closed-discipline — useful when the sharper question is what exact reserve, liquidity, and borrow helpers should have been forced to preserve one shared balance-sheet object instead of mixing raw balance and ledger state.
  • Positive-design companion on ambient-reserve quarantine: unexpected-balance-quarantine-and-explicit-recognition-discipline — useful when the sharper question is where direct donations, rescue top-ups, rebases, or other off-path reserve growth should have lived before any borrow or utilization path was allowed to treat them as economically active liquidity.
  • Positive-design companion on thin-market admission: collateral-admission-lag-and-borrow-side-quarantine — useful when the sharper question is why a dust or freshly distorted market was allowed to become full collateral truth for the rest of the system.
  • Positive-design companion on interest-recognition boundaries: reward-recognition-presentation-and-collateral-separation — useful when the sharper question is why paper depositor yield or rate-model output became immediate collateral authority before real reserve growth existed.
  • Recovery-side companion: low-supply-recovery-and-recapitalization-discipline — useful when the sharper question is how a thin, damaged, or near-empty market should re-enter safe operation without ambient donations or reserve drift redefining depositor economics.

Control surface

Graph View

Backlinks