# reclaimLiquidity() Malicious borrowers can force LPs to be unable to retrieve Liquidity by closing and reopening the Position before it expires

Borrowers can close and reopen positions before loan expiry, resetting lien.startTime and indefinitely blocking LPs from reclaiming liquidity.

- Payout: Contest reward
- Severity: medium
- Program: Particle Protocol
- Credited: bin2chen
- Disclosed: 2024-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-particle-findings/issues/35
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-09
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** lending/borrowing position lifecycle (openPosition/closePosition/reclaimLiquidity)
**Root cause:** openPosition() is not gated by the LP's renewalCutoffTime, so a borrower can close and reopen a position before LOAN_TERM expires, resetting lien.startTime and pushing liquidation eligibility out another full term.
**Steps:**
1. LP calls `reclaimLiquidity()` setting `renewalCutoffTime`
2. Borrower opens position with `LOAN_TERM = 7 days`
3. On day 6, borrower calls `closePosition()` then `openPosition()`; new `lien.startTime = block.timestamp`
4. LP must wait another 7 days; `liquidatePosition()` check `lien.startTime + LOAN_TERM < block.timestamp` fails
5. Borrower repeats step 3 indefinitely, paying only open fees
**How found:** Code reading of liquidatePosition's expiry condition combined with noticing openPosition lacks any renewalCutoffTime restriction, revealing the startTime reset loophole.
**Exploitation:** Borrower repeatedly rolls the position just before expiry, resetting startTime each cycle so the liquidation condition never becomes true, locking LP liquidity permanently while paying only recurring open fees.
**Insight:** When a protocol lets LPs signal intent to withdraw, check whether any state-resetting action (close/reopen, rollover) can reset the timers that gate forced liquidation; timers based on mutable startTime are resettable by the counterparty.