# paucheTranche state can be set to arbitrary value

Liquidation overwrites pauseTranche with the borrower's tier instead of taking the max, letting a low-tier liquidation unpause higher tranches and bypass the withdraw guard.

- Payout: Audit contest
- Severity: medium
- Program: Beta Finance
- Found by: ladboy233
- Disclosed: 2023-12-06
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-11-betafinance#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-betafinance%3AM-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:liquidation

**Target:** OmniPool/OmniToken tranche pause logic (Solidity)
**Root cause:** On liquidation, when borrowTrueValue exceeds depositTrueValue, pauseTranche is assigned borrowTier directly rather than max(borrowTier, pauseTranche), so a lower tier overwrites a higher paused tier.
**Steps:**
1. User A with borrower tier 10 gets liquidated with bad debt; `pauseTranche = 10` is set, blocking withdrawals for trancheId < 10.
2. User B with borrower tier 0 is liquidated with bad debt; `pauseTranche = 0` overwrites the prior value.
3. The guard `require(_trancheId < IOmniPool(omniPool).pauseTranche(), "OmniToken::withdraw: Tranche paused.")` now passes for all tranches, so users withdraw before socializeLoss().
**How found:** Code reading of the liquidation branch in OmniPool.sol and the withdraw guard in OmniToken.sol; noticed the assignment lacks a max() so a later lower-tier liquidation resets the paused state.
**Exploitation:** Attacker deposits/borrows in a chosen tranche and self-liquidates to drive bad debt, setting pauseTranche to an arbitrary value; this unpauses higher tranches so depositors can withdraw before socializeLoss() is applied, shifting bad debt onto remaining depositors.
**Escalation:** Attacker can pick any tranche tier to set pauseTranche to any value, effectively acting as admin to pause/unpause arbitrary tranches.
**Insight:** When a single state variable encodes a monotonic safety threshold (paused tranche), check every write site for overwrite vs. max/min semantics; a lower-severity event later can silently undo a higher-severity pause.