# Lender can reject closing a position

Lender of a Debt DAO credit line can revert ETH/ERC-777 repayment on close, blocking borrower from closing, rolling over, or releasing spigot funds.

- Payout: Contest reward
- Severity: medium
- Program: Debt DAO
- Credited: berndartmueller
- Disclosed: 2023-02-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-debtdao-findings/issues/467
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AM-11
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** LineOfCredit._close / depositAndClose in Solidity lending protocol
**Root cause:** _close pushes funds back to the lender via LineLib.sendOutTokenOrETH; if token is native ETH or ERC-777 with receiver hooks, the lender contract can revert the transfer, reverting the whole close.
**Steps:**
1. Borrower opens credit line with lender using native ETH (or ERC-777) as credit.token.
2. Borrower repays principal and calls depositAndClose() or close().
3. _close() calls LineLib.sendOutTokenOrETH(credit.token, credit.lender, deposit+interestRepaid).
4. Lender contract's receive/fallback (or ERC-777 hook) reverts, reverting the entire close transaction.
5. Borrower cannot close, rollover, release spigot, or sweep spigot tokens.
**How found:** Code review of _close push-payment pattern; recognized that push transfers to an attacker-controlled receiver can be griefed via revert, especially with native ETH/ERC-777 hooks.
**Exploitation:** Malicious lender deploys a contract whose ETH receive function reverts; borrower's close() always reverts, locking the position and blocking rollover/spigot release.
**Insight:** Any close/settle path that pushes ETH or hook-bearing tokens to a counterparty is griefable; check whether the counterparty controls the receiving contract and whether close is required for other user actions (rollover, collateral release).