# Borrower can craft a borrow that cannot be liquidated, even by arbiter. 

Borrower closes first credit line then borrows on second, leaving ids[0] empty so whileBorrowing() reverts, permanently blocking liquidation and repayment.

- Payout: Contest reward
- Severity: high
- Program: Debt DAO
- Credited: Trust
- Disclosed: 2023-02-07
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-11-debtdao-findings/issues/421
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AH-05
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LineOfCredit / CreditListLib credit queue (Solidity)
**Root cause:** _sortIntoQ skips the empty slot at ids[0] when sorting a new borrow, so a borrow can exist while ids[0] is zero; whileBorrowing() checks credits[ids[0]].principal==0 and reverts, disabling all liquidation/repay paths.
**Steps:**
1. `addCredit()` twice to create id1 at ids[0] and id2 at ids[1]
2. `close(id1)` -> removePosition deletes id1, ids = [0x0, id2]
3. `borrow(id2, 1 ether)` -> _sortIntoQ finds no valid swap target (id==bytes32(0)) and leaves id2 at index 1
4. ids[0] remains zero while id2 has principal; `whileBorrowing()` reverts NotBorrowing
5. After ttl, `healthcheck()` returns LIQUIDATABLE but `declareInsolvent()` reverts
**How found:** Hypothesized that corrupting ids so ids[0]==0 while other borrows exist would be severe because whileBorrowing() trusts ids[0]; read CreditListLib.removePosition/_sortIntoQ and found _sortIntoQ skips empty slots, then constructed the close-then-borrow sequence.
**Exploitation:** Borrower intentionally sequences addCredit/close/borrow so their active debt sits behind an empty ids[0]; arbiter's liquidate() and all depositAndRepay/claimAndRepay/claimAndTrade/depositAndClose calls revert on whileBorrowing(), letting borrower keep funds indefinitely.
**Insight:** When a contract uses ids[0] as a sentinel for 'has debt', check every path that mutates the array (remove/rotate/sort) for ways to leave index 0 empty while debt exists elsewhere; sorting routines that skip empty slots are prime suspects.