# Users may be liquidated right after taking maximal debt

Backed PaprController uses identical max LTV for borrowing and liquidation, so a user taking max debt is liquidatable in the same block.

- Payout: Contest reward
- Severity: high
- Program: Backed Protocol
- Credited: Jeiwan
- Disclosed: 2023-01-31
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-12-backed-findings/issues/190
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** PaprController lending contract (Solidity)
**Root cause:** Borrow check allows debt up to maxDebt while liquidation check triggers at debt >= maxDebt, using the same maxLTV with no gap between borrow LTV and liquidation LTV.
**Steps:**
1. Approve NFT and call `controller.addCollateral([collateral])`
2. Compute `maxDebt = controller.maxDebt(1 * oraclePrice)`
3. Call `controller.increaseDebt(borrower, collateral.addr, maxDebt, oracleInfo)` taking maximal debt
4. Set priceKind to TWAP so oracle price equals LOWER price
5. Call `controller.startLiquidationAuction(borrower, collateral, twapOracleInfo)` in same block; succeeds because `info.debt < _maxDebt(...)` is false
**How found:** Code reading of the borrow guard (`newDebt > max` revert) versus the liquidation guard (`info.debt < _maxDebt` revert) revealed both use the same maxLTV; noted LOWER price is min(SPOT,TWAP) so the two price kinds can coincide, eliminating any implicit gap.
**Exploitation:** MEV bot observes a max-debt borrow and, since LOWER price can equal TWAP, immediately triggers startLiquidationAuction in the same block, seizing collateral via auction before the borrower can add collateral or repay.
**Insight:** When auditing lending markets, compare the borrow-side LTV check and the liquidation-side threshold: if both derive from one maxLTV with no separate liquidation threshold, max borrows are instantly liquidatable and MEV bots will race them.