# Last Trove may be prevented from redeeming

Multi-collateral LUSD invariant check in RedemptionHelper lets a griefer send the last trove holder LUSD to block redemption.

- Payout: Contest reward
- Severity: medium
- Program: Ethos Reserve
- Credited: ltyu
- Disclosed: 2023-05-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-02-ethos-findings/issues/381
- Library page: https://bugbountylibrary.com/r/c4%3A2023-02-ethos%3AM-09
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** RedemptionHelper.redeemCollateral LUSD balance assertion
**Root cause:** redeemCollateral asserts redeemer's LUSD balance <= total system debt for that collateral, but in a multi-collateral system each collateral tracks its own debt while sharing one LUSD token, so the invariant no longer holds.
**Steps:**
1. Setup: wBTC troves hold 10000 LUSD debt, wETH troves hold 100 LUSD debt, Stability Pool has 150 LUSD.
2. ETH price crashes; all wETH troves liquidated except the last one.
3. Griefer front-runs the last trove holder's redeemCollateral call by transferring them `entireSystemDebt + 1` LUSD.
4. The `assert(lusdToken.balanceOf(_redeemer) <= totals.totalLUSDSupplyAtStart)` in redeemCollateral now reverts, blocking redemption.
**How found:** Code review of redeemCollateral's LUSD balance assertion, recognizing the single-collateral Liquity invariant does not hold in a multi-collateral fork sharing one LUSD token.
**Exploitation:** Attacker monitors the mempool for a redeemCollateral tx from the last remaining trove holder and front-runs with a small LUSD transfer to push the victim's balance above the per-collateral debt, causing the assertion to revert and denying redemption.
**Insight:** When a protocol forks a single-collateral design into multi-collateral, audit every invariant that assumes one shared debt/supply; balance-vs-debt assertions become griefable when supply is shared across isolated debt pools.