# Borrowers can avoid liquidations, if ERC777 token is configured as an emissionToken

Liquidation calls reward disbursement; an ERC777 emission token's tokensReceived hook lets an undercollateralized borrower revert, blocking liquidation and accruing bad debt.

- Payout: Audit contest
- Severity: medium
- Program: Moonwell
- Found by: Udsen
- Disclosed: 2023-10-04
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-07-moonwell#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-moonwell%3AM-01
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:dos

**Target:** Lending market liquidation path with MultiRewardDistributor emission tokens
**Root cause:** liquidateBorrowFresh -> repayBorrowFresh -> Comptroller.repayBorrowAllowed triggers MultiRewardDistributor.updateMarketBorrowIndexAndDisburseBorrowerRewards, which safeTransfers emission tokens to the borrower inside the liquidation call; an ERC777 emission token invokes the borrower's tokensReceived hook, which can revert the whole liquidation.
**Steps:**
1. Configure an ERC777 token as an emissionToken in the MToken market's MultiRewardDistributor emission config.
2. Borrower becomes undercollateralized while holding accrued rewards.
3. Liquidator calls `MErc20.liquidateBorrow(borrower, repayAmount, mTokenCollateral)`.
4. Path: liquidateBorrowInternal -> `repayBorrowFresh(liquidator, borrower, repayAmount)` -> repayBorrowAllowed -> updateMarketBorrowIndexAndDisburseBorrowerRewards -> disburseBorrowerRewardsInternal -> sendReward.
5. sendReward executes `token.safeTransfer(_user, _amount)`; ERC777 calls borrower's tokensReceived hook, which reverts, reverting the liquidation.
**How found:** Code-reading of the liquidation call chain, noticing reward disbursement (external token transfer) occurs inside repayBorrowAllowed, then reasoning that a hook-capable emission token gives the borrower control mid-liquidation.
**Exploitation:** Borrower contract implements a reverting tokensReceived hook; every liquidation attempt reverts at reward payout, so the position cannot be liquidated and bad debt accrues to the protocol.
**Escalation:** Judge notes avoiding liquidation accrues bad debt and can be compounded with other vulnerabilities.
**Insight:** Trace external token transfers embedded in 'allowed' checks of liquidation/repay paths; any hook-capable token (ERC777/ERC677) paid to the borrower turns the liquidation into attacker-controlled execution that can revert.