# Liquidations can be prevented by frontrunning and liquidating 1 debt (or more) due to wrong assumption in POS\_MANAGER

PosManager assumes debt share value always increases; a 1-wei self-liquidation frontrun makes subsequent liquidations revert, blocking liquidators.

- Payout: Contest reward
- Severity: high
- Program: INIT Capital
- Credited: 0x73696d616f
- Disclosed: 2024-01-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-12-initcapital-findings/issues/42
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AH-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:liquidation

**Target:** PosManager / LendingPool debt share accounting
**Root cause:** updatePosDebtShares() assumes debtShareToAmtCurrent is monotonically increasing, but a liquidation reduces current debt, so totalInterest accounting reverts on the next update within the same block.
**Steps:**
1. Create position: collateralize USDT, borrow WBTC.
2. Warp 1 second and call `accrueInterest()` so debt shares exist.
3. Attacker frontruns liquidator with `_liquidate(liquidator, posId, 1, poolWBTC, poolUSDT, false, '')` (1 wei).
4. Liquidator's subsequent `_liquidate(..., 1000, ...)` reverts because shares are now worth 1 less and totalInterest math underflows/reverts.
**How found:** Code reading of PosManager.updatePosDebtShares() revealed the monotonic-increase assumption on debtShareToAmtCurrent; reasoned that liquidation reduces debt, then wrote a Foundry PoC frontrunning a liquidation with a 1-wei liquidate.
**Exploitation:** Borrower monitors mempool for liquidation tx, submits a 1-wei self-liquidation with higher gas; same-block timestamp means no new interest accrues, so the victim liquidation reverts. Repeating keeps position unliquidated until interest accrual exceeds the pre-liquidation debt value.
**Escalation:** Partial larger self-liquidation extends the window until accrued interest reaches the last debt value, delaying liquidation further.
**Insight:** When a contract caches a derived value (totalInterest) assuming monotonic growth of a share price, check every path that can decrease it—liquidations, repayments, write-offs—and test same-block sequences where no interest accrues between calls.