# An attacker can easily bypass the collateral value limit factor checks

Collateral value limit factor check is skipped on withdraw, letting an attacker supply, borrow, and withdraw in one tx to exceed the configured limit.

- Payout: Contest reward
- Severity: medium
- Program: Revert Lend
- Credited: Arz
- Disclosed: 2024-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-revert-lend-findings/issues/466
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** V3Vault lending contract collateral accounting
**Root cause:** _updateAndCheckCollateral() enforces the collateral value limit factor on supply/borrow but not on withdraw of lent tokens, so a supply→borrow→withdraw sequence in one transaction leaves debt above the allowed limit.
**Steps:**
1. Set token config collateral value limit factor to 90% via `vault.setTokenConfig(DAI, Q32*9/10, Q32*9/10)`.
2. Existing state: 10 USDC lent, 2 USDC borrowed; limit allows only ~1 USDC more borrow.
3. Attacker calls `_deposit(2e6)` supplying 2 USDC.
4. Attacker calls `_createAndBorrow(TEST_NFT_2, ..., 2e6)` borrowing 2 USDC.
5. Attacker calls `vault.withdraw(2e6, ...)` withdrawing the supplied 2 USDC.
6. Result: total debt shares exceed the 90% collateral limit; subsequent `_updateAndCheckCollateral()` calls (e.g. AutoRange position replacement) revert.
**How found:** Code reading of _updateAndCheckCollateral() revealed the limit check is applied on supply/borrow paths but omitted from the withdraw path, enabling a same-tx supply/borrow/withdraw to exceed the limit.
**Exploitation:** Single-transaction sequence: supply collateral, borrow against it, then immediately withdraw the supplied lent tokens. The withdraw path does not re-run the collateral value limit check, so the position ends with debt exceeding the configured limit factor.
**Escalation:** Side effect: AutoRange automator calls that invoke _updateAndCheckCollateral() revert, blocking range changes for positions.
**Insight:** When a limit check lives in a shared accounting function, verify every state-changing entry point (especially withdraw/redeem) invokes it; same-transaction deposit+borrow+withdraw can leave invariants violated if any path skips the check.