# Denial of Liquidations and Redemptions by borrowing all reserves from AAVE

Attacker borrows all WETH reserves from Granary/AAVE, making Strategy.withdraw revert and bricking ActivePool._rebalance, freezing liquidations and redemptions.

- Payout: Contest reward
- Severity: medium
- Program: Ethos Reserve
- Credited: GalloDaSballo
- Disclosed: 2023-05-02
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-02-ethos-findings/issues/693
- Library page: https://bugbountylibrary.com/r/c4%3A2023-02-ethos%3AM-06
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:liquidation

**Target:** ActivePool._rebalance / ReaperStrategyGranarySupplyOnly lending pool withdrawal
**Root cause:** ActivePool._rebalance pulls collateral from the Reaper vault strategy, which withdraws from AAVE/Granary; if the lending pool has no liquidity, withdraw reverts and _rebalance reverts, blocking all collateral-decreasing operations.
**Steps:**
1. Fork Optimism; identify Granary LendingPool `0x8FD4aF47E4E63d1D2D45582c3286b4BD9Bb95DfE` and aToken `0xfF94cc8E2c4B17e3CC65d7B83c7e8c643030D936`.
2. Fund strategy with 20 WETH and `lp.deposit(weth, 20e18, strategy, 0)` so strategy holds aTokens.
3. Fund exploiter with USDC, `lp.deposit(usdc, balance, exploiter, 0)` as collateral.
4. `lp.borrow(weth, weth.balanceOf(a_token), 2, 0, exploiter)` drains all borrowable WETH.
5. Strategy calls `lp.withdraw(weth, a_token.balanceOf(strategy), strategy)` -> reverts `SafeMath: subtraction overflow`.
6. Any ActivePool operation with negative netAssetMovement now reverts in `_rebalance`, blocking liquidations/redemptions.
**How found:** Code reading of ActivePool._rebalance and ReaperStrategyGranarySupplyOnly: noticed every collateral-decreasing op triggers a vault withdraw that cascades to LendingPool.withdraw, and that AAVE by design lends out all reserves, so an attacker can empty the pool to force a revert.
**Exploitation:** Attacker supplies collateral (e.g. USDC) to Granary and borrows the entire WETH reserve, leaving zero liquidity. Subsequent Strategy withdrawals revert, so ActivePool._rebalance reverts on every collateral-decreasing operation. Attacker can hold the position (cost ~3%/day even at 1000% APR) to freeze liquidations/redemptions, force recovery mode, and potentially trigger bad debt; front-running a victim tx only reduces interest cost.
**Escalation:** Can be pushed to force Recovery Mode, re-absorptions, and bad debt; if LUSD is shortable, attacker can profit from the resulting peg break.
**Insight:** When a protocol routes user withdrawals through an external money market, treat that market's liquidity as attacker-drainable: check whether a single borrower can empty the reserve and whether the resulting revert blocks core ops like liquidation.