# malicious borrowers can follow reclaimLiquidity() then execute addPremium() to invalidate renewalCutoffTime

Borrower front-runs LP's reclaimLiquidity() with addPremium(0), setting lien.startTime equal to renewalCutoffTime and blocking forced liquidation indefinitely.

- Payout: Contest reward
- Severity: medium
- Program: Particle Protocol
- Credited: bin2chen
- Disclosed: 2024-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-particle-findings/issues/33
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-10
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:liquidation

**Target:** Solidity lending lien contract (addPremium/liquidatePosition)
**Root cause:** addPremium checks `renewalCutoffTime > lien.startTime` with strict `>`, so when reclaimLiquidity sets cutoff equal to current timestamp, addPremium(0) still succeeds and resets lien.startTime to that same timestamp.
**Steps:**
1. LP calls `reclaimLiquidity()` setting `renewalCutoffTime = block.timestamp`.
2. Borrower monitors mempool and front-runs/follows in same block with `addPremium(lienId, 0, 0)`.
3. Check `renewalCutoffTime > lien.startTime` is false (equal), so call passes and `lien.startTime = block.timestamp`.
4. LP calls `liquidatePosition()`; condition `lien.startTime < renewalCutoffTime` is false, reverts `LiquidationNotMet()`.
5. Repeat each time LP retries reclaimLiquidity to indefinitely block closure.
**How found:** Code reading of liquidatePosition's cutoff condition versus addPremium's strict `>` guard; noticed equality case slips through and startTime is reset to block.timestamp.
**Exploitation:** Borrower watches mempool for reclaimLiquidity, submits addPremium(0) in same block to keep lien.startTime == renewalCutoffTime, preventing LP from force-closing the position and retrieving liquidity.
**Insight:** When a guard compares a mutable timestamp against a cutoff, check the equality boundary: a strict `>` lets an attacker who can reset the timestamp to exactly the cutoff defeat the check. Look for setters that write block.timestamp and compare them against cutoff logic.