# Both buyAllAmountWithLeverage and sellAllAmountWithLeverage always revert

Position._maxBorrow reverts when a griefer sends 1 wei bathToken to a fresh Position, permanently blocking leveraged position opening.

- Payout: Contest reward
- Severity: medium
- Program: Rubicon
- Credited: nobody2018
- Disclosed: 2025-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-rubicon-findings/issues/293
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AM-27
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Position.sol leveraged position contract (Compound-style comptroller/bathToken)
**Root cause:** _borrowLimit uses IERC20(_bathToken).balanceOf(address(this)) as the 'collateral supplied' check, but a fresh Position has zero comptroller liquidity, so _maxBorrow's require(_liq > 0) reverts once any bathToken balance exists.
**Steps:**
1. Attacker transfers 1 wei of any BathHouseV2-supported bathToken to a newly created Position contract (front-run the openPosition call, or pre-seed after creation).
2. Victim calls buyAllAmountWithLeverage/sellAllAmountWithLeverage -> openPosition -> _borrowLimit.
3. balanceOf(_bathToken) != 0 so _maxBorrow is invoked.
4. comptroller.getAccountLiquidity(address(this)) returns _liq == 0 for the fresh Position, so `require(_liq > 0, "_maxBorrow: LIQUIDITY == 0")` reverts.
5. Every leveraged open reverts; DoS persists for all users.
**How found:** Code reading of _borrowLimit: noticed the collateral check uses bathToken balanceOf rather than comptroller liquidity, then traced that _maxBorrow requires _liq > 0 which a fresh Position never satisfies.
**Exploitation:** Griefer needs only 1 wei per Position (or front-runs the tx) to make _maxBorrow revert; no capital or privilege required, blocking all leveraged position opening.
**Insight:** When a contract uses token balance as a proxy for 'has collateral', any external transfer (even 1 wei) can flip that branch; check whether the downstream path assumes state (comptroller liquidity) that the balance does not imply.