# If the borrower enters token blacklist, LP may never be able to retrieve Liquidity

If a borrower is blacklisted by a loan token (e.g. USDC), refundWithCheck's safeTransfer reverts, blocking closePosition/liquidation and locking LP liquidity.

- Payout: Contest reward
- Severity: high
- Program: Particle Protocol
- Credited: bin2chen
- Disclosed: 2024-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-particle-findings/issues/31
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AH-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** Lending/leverage position close and liquidation refund path (Solidity contract)
**Root cause:** _closePosition unconditionally calls refundWithCheck -> TransferHelper.safeTransfer to return surplus to the borrower; if the borrower is blacklisted by token0/token1, the transfer reverts, reverting the whole close/liquidation.
**Steps:**
1. Borrower opens a leveraged position with token0/token1 (e.g. USDC) while not blacklisted.
2. Borrower later gets blacklisted by the token issuer.
3. Position becomes profitable or loan expires with surplus owed to borrower.
4. Call `closePosition()` or `liquidatePosition()` -> `_closePosition()`; `refundWithCheck` -> `TransferHelper.safeTransfer(token, borrower, surplus)` reverts.
5. Entire `_closePosition()` reverts; LP liquidity remains locked and unhealthy positions cannot be liquidated.
**How found:** Code reading of the close/liquidation refund path: noticed refundWithCheck always transfers surplus to the borrower, and reasoned that a token blacklist on the borrower would make safeTransfer revert, bricking closePosition and liquidation.
**Exploitation:** Not an attacker-driven exploit; a griefing/edge-case DoS where a blacklisted borrower's position cannot be closed or liquidated, leaving LP funds stuck and risking bad debt.
**Insight:** When auditing refund/withdrawal paths, check whether any unconditional transfer to a user-controlled recipient can revert (blacklists, non-standard tokens) and thereby block liquidation or close flows that LPs depend on.