# Inability to offboard term twice in a 7-day period may lead to bad debt to the market

Offboarding poll cooldown blocks re-offboarding a re-onboarded LendingTerm within 7 days, letting adverse terms accrue bad debt that slashes voters.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: santipu\_
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/370
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-20
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** LendingTermOffboarding contract (proposeOffboard poll cooldown)
**Root cause:** proposeOffboard requires block.number > lastPollBlock[term] + POLL_DURATION_BLOCKS, and lastPollBlock is never reset on successful offboard, so a term offboarded and re-onboarded within 7 days cannot be offboarded again.
**Steps:**
1. Mint quorum GUILD to bob, delegate, call `offboarder.proposeOffboard(term)` at snapshotBlock
2. Roll 1 block, warp 13s, call `offboarder.supportOffboard(snapshotBlock, term)` then `offboarder.offboard(term)`
3. Repay alice's loan, call `offboarder.cleanup(term)`
4. Roll ~33230 blocks / 5 days, re-onboard via `guild.addGauge(1, term)`
5. Roll ~6646 blocks / 1 day, call `offboarder.proposeOffboard(term)` -> reverts `LendingTermOffboarding: poll active`
**How found:** Reading proposeOffboard's cooldown check and noticing lastPollBlock is never cleared on successful offboard, combined with the protocol's support for re-onboarding terms and thousands of terms per market.
**Exploitation:** If a term is offboarded and re-onboarded within 7 days and market conditions then deteriorate, GUILD voters cannot trigger a second offboarding poll; loans default, voters are slashed and CREDIT holders take losses.
**Insight:** When a cooldown/timestamp guard is keyed on an entity that can be removed and re-added, check whether the timestamp is reset on the lifecycle transition (offboard/cleanup); stale cooldown state can block emergency actions on re-onboarded entities.