# Lender is able to seize the collateral by changing the loan parameters

Lender sets ltvBPS to 0 via updateLoanParams, making the collateral-removal LTV check always pass, letting them seize borrower collateral early.

- Payout: Audit contest
- Severity: high
- Program: Abracadabra Money
- Credited: Ruhum
- Disclosed: 2022-07-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-abranft-findings/issues/51
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** NFTPairWithOracle lending contract (updateLoanParams/removeCollateral)
**Root cause:** updateLoanParams lets the lender set ltvBPS to 0; removeCollateral's require `rate * ltvBPS / BPS < amount` then always holds, so the collateral can be removed regardless of loan health or repayment status.
**Steps:**
1. Lender funds the loan to borrower.
2. Lender calls `updateLoanParams()` setting `ltvBPS = 0`.
3. Lender calls `removeCollateral()`; require `rate * 0 / BPS < amount` is always true, seizing collateral.
**How found:** Code review of updateLoanParams and removeCollateral: noticed ltvBPS is lender-mutable and that the LTV require in removeCollateral degenerates to always-true when ltvBPS is 0.
**Exploitation:** Lender, as the party controlling loan params, zeroes ltvBPS on an active loan then calls removeCollateral to pull the borrower's NFT collateral before repayment deadline or any value drop.
**Insight:** When a parameter is both user-settable and used as a divisor/multiplier in a safety check, test the boundary value (0) — a zeroed LTV threshold turns the health check into a no-op, granting unconditional collateral withdrawal.