# User can pass auction recovery health check easily with flashloan

ParaSpace auction recovery health check only validates health factor at tx time, so a user can flashloan collateral, cancel their NFT auction, then withdraw and repay.

- Payout: Contest reward
- Severity: high
- Program: ParaSpace
- Credited: Trust
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-paraspace-findings/issues/478
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AH-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:liquidation

**Target:** NFT lending pool auction recovery / setAuctionValidityTime
**Root cause:** setAuctionValidityTime checks erc721HealthFactor > auctionRecoveryHealthFactor only at execution time, with no time-lock or persistence requirement on the supplied collateral.
**Steps:**
1. Place NFT as collateral and borrow against it.
2. NFT price drops; health factor falls below liquidation threshold; auction initiates.
3. Deposit just enough to be above liquidation threshold.
4. Flashloan 1000 WETH; `supply(1000 WETH)` to protocol.
5. Call `setAuctionValidityTime()` to invalidate the auction (passes health factor check).
6. `withdraw(1000 WETH)` and repay flashloan.
**How found:** Observed that the recovery check reads instantaneous health factor at tx execution and that supply/withdraw are permissionless within one flow, so a temporary balance inflation satisfies the check without real recovery.
**Exploitation:** Attacker flashloans large capital, temporarily supplies it as collateral to satisfy the recovery health factor check, calls setAuctionValidityTime to cancel the auction, then withdraws the collateral and repays the flashloan in the same transaction sequence, leaving the position undercollateralized but auction cancelled.
**Insight:** When a health/solvency gate is evaluated only at tx time and collateral can be supplied and withdrawn freely, test whether a flashloan-funded temporary deposit passes the gate and is then unwound; reentrancy guards don't help because steps are sequential.