# Removing markets from WildcatArchController gives lenders immunity from sanctions

Removed markets fail the isRegisteredMarket check in createEscrow, so nukeFromOrbit and executeWithdrawal revert, letting sanctioned lenders keep interacting with the market.

- Payout: Contest reward
- Severity: medium
- Program: Wildcat Protocol
- Credited: MiloTruck
- Disclosed: 2023-12-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-wildcat-findings/issues/498
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** WildcatSanctionsSentinel.createEscrow / WildcatArchController market registry
**Root cause:** createEscrow only checks isRegisteredMarket(msg.sender); markets removed via removeMarket() are no longer registered, so escrow creation reverts for them even though they still operate.
**Steps:**
1. Deploy archController, sentinel, controllerFactory; register factory and borrower.
2. Borrower deploys market; lender deposits and queues withdrawal.
3. Sanction lender via Chainalysis mock; call `archController.removeMarket(address(market))`.
4. Call `market.nukeFromOrbit(DUEET)` -> reverts `NotRegisteredMarket`.
5. Call `market.executeWithdrawal(DUEET, uint32(block.timestamp))` -> reverts `NotRegisteredMarket`.
**How found:** Code-reading of createEscrow's registration check against the removeMarket lifecycle, noticing removed markets still operate but fail the check.
**Exploitation:** A sanctioned lender in a removed market cannot be nuked and can still transfer market tokens, deposit, and queue withdrawals; they also cannot execute their own withdrawal into escrow.
**Insight:** When a registry has both add and remove operations, audit every downstream `isRegistered`/membership check for whether removed-but-still-live entities must also pass; lifecycle asymmetry breaks compliance hooks.