# Borrower can cause a DoS by frontrunning a liquidation and repaying as low as 1 wei of the current debt

Borrower frontruns a full-position liquidation by repaying 1 wei, shrinking maxClose below the liquidator's repayAmount and reverting the liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Venus Protocol
- Credited: 0xStalin
- Disclosed: 2023-08-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-venus-findings/issues/255
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-08
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:dos

**Target:** Comptroller preLiquidateHook liquidation validation
**Root cause:** preLiquidateHook reverts when repayAmount exceeds maxClose, which is recomputed from the current borrowBalance at execution time; any debt reduction between submission and execution makes a full-close repayAmount invalid.
**Steps:**
1. Liquidator submits liquidation with repayAmount equal to current maxClose (100% of position).
2. Borrower frontruns and repays as little as 1 wei of debt, lowering borrowBalance.
3. On execution, maxClose is recalculated from the reduced borrowBalance and is now less than repayAmount.
4. Check `if (repayAmount > maxClose) revert TooMuchRepay()` triggers; liquidation reverts though position remains liquidatable.
**How found:** Code reading of preLiquidateHook: noticed maxClose derived from live borrowBalance while repayAmount is fixed at submission, making the comparison sensitive to any intervening debt change.
**Exploitation:** Borrower monitors mempool for full-liquidation tx, sends a minimal repay tx with higher gas to reduce borrowBalance, causing liquidator tx to revert; repeatable at gas cost to borrower.
**Insight:** When a validation compares a caller-supplied amount against a value recomputed from live state, look for cheap state mutations (tiny repayments, donations) that shift the recomputed bound and revert otherwise-valid calls.