# A malicious user can potentially escape liquidation by creating a dust amount position and trigger the liquidation by themself

A liquidated Mochi position can be reused; a dust self-liquidation auction blocks triggerLiquidation, letting a borrower escape real liquidation.

- Payout: Audit contest
- Severity: medium
- Program: Mochi
- Found by: WatchPug
- Disclosed: 2021-11-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-10-mochi-findings/issues/127
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-mochi%3AM-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium technique:chained vuln:business-logic vuln:liquidation

**Target:** Mochi lending/borrowing liquidation contract
**Root cause:** A position under an ongoing liquidation auction can still be used to deposit and borrow, and triggerLiquidation reverts while an auction is unsettled, so a stale dust auction blocks new liquidations.
**Steps:**
1. Create a dust position and self-trigger liquidation, leaving an unprofitable auction open.
2. Liquidators ignore the dust auction since collateral cannot cover gas.
3. Deposit and borrow the real loan on the same position.
4. When the real loan becomes liquidatable, triggerLiquidation reverts until the dust auction is settled, confusing/blocking liquidators.
**How found:** Observed that liquidated positions remain usable for deposit/borrow and that triggerLiquidation fails while an auction is ongoing, then reasoned about liquidator incentives on an unprofitable auction.
**Exploitation:** Attacker opens a worthless self-liquidation auction on their own position, then borrows a real loan on it; liquidators must settle the unprofitable dust auction before liquidating the real debt, so they skip it and the attacker escapes liquidation.
**Insight:** Check whether a liquidated/auction-active account can still open new debt, and whether an unsettled auction blocks re-triggering liquidation; a cheap self-auction can grief liquidator bots.