# setPosMode should not allow changing the mode when the new mode's canRepay status is disabled

setPosMode omits a canRepay check on the new mode, letting a borrower switch into a paused-repay mode to block liquidation of an unhealthy position.

- Payout: Contest reward
- Severity: medium
- Program: INIT Capital
- Credited: said
- Disclosed: 2024-01-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-initcapital-findings/issues/26
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:liquidation

**Target:** InitCore.setPosMode / mode config in lending protocol
**Root cause:** setPosMode validates newModeStatus.canBorrow and currentModeStatus.canRepay but never checks newModeStatus.canRepay, so a position can be moved into a mode where repay/liquidation is paused.
**Steps:**
1. Observe position health approaching liquidation threshold.
2. Call `setPosMode(_posId, _mode)` where `_mode` has `canRepay == false` but `canBorrow == true` and allows the position's collaterals/debts.
3. Position mode updates; `_repay` now reverts with `REPAY_PAUSED` because `getModeStatus(_mode).canRepay` is false.
4. Liquidators calling `liquidate`/`liquidateWLp` revert, position cannot be repaid or liquidated.
**How found:** Code review of setPosMode's require checks noticed the asymmetry: canBorrow of new mode and canRepay of current mode are checked, but canRepay of the new mode is not, then traced _repay's canRepay gate used by liquidation.
**Exploitation:** Borrower front-runs liquidation by switching to a canRepay-disabled mode, making _repay revert and blocking both liquidation paths, leaving bad debt uncollectable.
**Insight:** When a function migrates state between two configs (modes/pools), audit that every pause/status flag enforced on the destination path is validated for the destination config, not just the source; asymmetric require checks are a common liquidation-bypass vector.