# Borrower can abuse enterMarkets to force liquidator can pay more funds

Borrower can call enterMarkets with many high-tranche markets, forcing liquidators to pay unbounded gas in accrue loops and blocking liquidation.

- Payout: Audit contest
- Severity: medium
- Program: Beta Finance
- Found by: ladboy233
- Disclosed: 2023-12-06
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-11-betafinance#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-betafinance%3AM-01
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** OmniPool liquidation / enterMarkets
**Root cause:** enterMarkets has no cap on number of markets and no check for existing borrow positions; liquidation's _evaluateAccountInternal loops over all pool markets calling accrue(), each iterating up to 255 tranches, making gas unbounded.
**Steps:**
1. Borrower deposits and borrows against a market via pool.borrow.
2. Borrower calls pool.enterMarkets(0, newMarkets) with up to 1000 freshly created OmniToken markets with high tranche counts.
3. Liquidator calls pool.liquidate(...); _evaluateAccountInternal loops over all poolMarkets calling IOmniToken.accrue() for each.
4. Gas measured: 159,429 without extra markets vs 31,572,426 with 1000 markets added.
5. Liquidator's gas cost exceeds liquidation bonus, so liquidation is skipped and bad debt accrues.
**How found:** Code review of liquidation path noticed _evaluateAccountInternal loops over all pool markets calling accrue(), and enterMarkets lacks a cap or borrow-position check, so borrower controls loop length.
**Exploitation:** Borrower front-runs liquidation by entering many markets with high tranche counts that have not accrued interest, inflating the liquidator's accrue loop gas cost beyond the liquidation bonus, deterring liquidation and leaving bad debt.
**Escalation:** Adding enough markets can exceed block gas limit, fully blocking liquidation and making the pool insolvent.
**Insight:** In lending protocols, any user-controlled array iterated during liquidation (markets, tranches, reserves) is a gas-griefing vector; check whether entry functions cap list length and whether liquidation loops over user-added entries.