# Anyone can liquidate credit line when autoLiquidation is false without supplying borrow tokens

CreditLine.liquidate omits a lender check when autoLiquidation is false, letting anyone liquidate and seize all collateral without paying borrow tokens.

- Payout: Audit contest
- Severity: high
- Program: Sublime
- Found by: harleythedog
- Disclosed: 2022-02-14
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-12-sublime-findings/issues/96
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:regression technique:source-review vuln:access-control vuln:business-logic

**Target:** CreditLine.sol liquidate() function
**Root cause:** The autoLiquidation flag is only used to gate the borrow-token transfer block; no require enforces msg.sender == lender when autoLiquidation is false, so the lender-only restriction is never applied.
**Steps:**
1. Read liquidate() at CreditLine.sol#L996; note autoLiquidation only appears in `if (creditLineConstants[_id].autoLiquidation && _lender != msg.sender)`.
2. Create a credit line with autoLiquidation=false and a borrower position.
3. Call liquidate(_id, ...) from an arbitrary non-lender address.
4. Observe the if-block is skipped (no borrow-token transfer) and `_transferCollateral` sends all collateral to the caller.
5. Confirm by flipping `_autoLiquidation` to false in test/CreditLines/2.spec.ts line 238; all tests including 'Liquidate credit line' with admin as liquidator still pass.
**How found:** Code reading of liquidate(): noticed autoLiquidation is referenced only once, inside the borrow-token transfer condition, and that no separate check restricts the caller to the lender when the flag is false. Verified by mutating the existing Hardhat test's autoLiquidation flag to false and seeing the admin-as-liquidator test still pass.
**Exploitation:** Attacker calls liquidate on any non-autoLiquidation credit line; since the borrow-token transfer is skipped, they receive the full collateral without paying anything, while the lender loses the collateral owed to them.
**Insight:** When a boolean flag gates a privileged branch, check whether the negative case has its own authorization check — here the 'lender-only' invariant was assumed but only enforced inside the autoLiquidation branch. Mutating existing tests' config flags is a cheap way to expose missing guards.