# anti-flashloan mechanism may lead to protocol default

OpenLeverage liquidation reverts when spot price is >5% below TWAP, so during a fast drawdown liquidations keep failing and positions stay under-collateralized.

- Payout: Audit contest
- Severity: medium
- Program: OpenLeverage
- Found by: gzeon
- Disclosed: 2022-03-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-openleverage-findings/issues/233
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-openleverage%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:liquidation vuln:oracle-manipulation

**Target:** Lending protocol liquidation price check (OpenLevV1Lib)
**Root cause:** Liquidation path requires spot price not more than maxLiquidationPriceDiffientRatio below cAvgPrice, reverting with 'MPT' whenever spot trades >5% under TWAP, which is exactly the condition during a sharp market drop.
**Steps:**
1. Observe liquidation check in OpenLevV1Lib.sol L191: `if (prices.price < prices.cAvgPrice) { require(differencePriceRatio - 100 < maxLiquidationPriceDiffientRatio, 'MPT'); }`
2. During sustained downward price action, spot price stays >5% below the stored TWAP.
3. Any liquidation call hits the require and reverts with 'MPT', so under-collateralized positions cannot be closed.
4. Protocol accrues bad debt as positions remain open while collateral value falls.
**How found:** Code review of the liquidation price guard: noticed the anti-flashloan check reverts liquidations whenever spot is significantly below TWAP, and reasoned that a persistent drawdown keeps that condition true, blocking all liquidations.
**Insight:** Anti-manipulation guards that gate liquidations on spot-vs-TWAP divergence can themselves become a DoS on liquidations during real crashes; check whether the safety check's trigger condition overlaps with the scenario it is meant to protect against.