# Shrine's recovery mode can be weaponized as leverage to liquidate healthy troves

Opening a large loan pushes Shrine LTV past 70% of threshold, triggering recovery mode that lowers thresholds and makes healthy troves liquidatable in one tx.

- Payout: Contest reward
- Severity: high
- Program: Opus
- Credited: 3docSec
- Disclosed: 2024-03-08
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2024-01-opus-findings/issues/9
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:chained vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** Shrine lending contract (Cairo) trove health/recovery mode logic
**Root cause:** Recovery mode triggers when shrine LTV >= 70% of nominal threshold, and scale_threshold_for_recovery_mode lowers per-trove thresholds, so a single large borrow can push the system into recovery mode and make previously healthy troves liquidatable.
**Steps:**
1. Deposit collateral into a new trove (e.g. flash-loaned 10 wad) and forge ~85% of max forge to raise global shrine LTV above 70% of threshold.
2. Confirm `shrine.is_recovery_mode()` returns true and a pre-existing trove's `ltv > threshold`.
3. Liquidate the now-unhealthy trove(s) for profit.
4. Repay/close the attacker trove within the same transaction to avoid exposure.
**How found:** Code reading of get_trove_health/scale_threshold_for_recovery_mode and is_recovery_mode_helper revealed recovery mode is triggered by global LTV ratio rather than price moves, and that borrowing is permitted above the 70% recovery threshold but below liquidation threshold, enabling manipulation.
**Exploitation:** Attacker flash-loans collateral, opens a large trove borrowing near the collateralization limit to force shrine LTV above the recovery-mode trigger, which scales down all trove thresholds; healthy troves become liquidatable and are liquidated for profit, then the attacker's position is closed in the same transaction with no liquidation risk.
**Escalation:** Single-transaction flash-loan execution removes capital risk; can be repeated or done with pre-deposited dormant collateral.
**Insight:** When a protocol's global safety mode is triggered by an aggregate LTV ratio, check whether users can borrow at LTVs above that trigger but below liquidation; if so, one large position can flip the whole system into the punitive mode and weaponize it against others.