# Lack of safety buffer in _checkLoanIsHealthy could subject users who take out the max loan into a forced liquidation

V3Vault borrow allowed max loan with no safety buffer between LTV and liquidation threshold, letting an attacker manipulate the Uniswap pool to force liquidation of a maxed-out borrower.

- Payout: Contest reward
- Severity: medium
- Program: Revert Lend
- Credited: CRYP70
- Disclosed: 2024-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-revert-lend-findings/issues/363
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:liquidation vuln:oracle-manipulation

**Target:** V3Vault lending contract / _checkLoanIsHealthy health check
**Root cause:** _checkLoanIsHealthy compares collateralValue (collateral factor applied) directly against debt with no buffer below the liquidation threshold, so a max borrow sits exactly at the liquidation boundary and any minor price move makes it liquidatable.
**Steps:**
1. Deploy V3Vault with USDC/DAI/WETH collateral factors at 90% and oracle configs.
2. Alice mints a USDC/WETH Uniswap V3 LP NFT, calls `vault.create(tokenId)` and `vault.borrow(tokenId, collateralValue)` borrowing the max.
3. Eve obtains 30 WETH (flash loan), swaps WETH->USDC via SwapRouter `exactInputSingle` to sink the pool price.
4. Eve calls `vault.liquidate` with `debtShares = tv.debt` to seize the collateral.
5. Eve swaps seized USDC back to WETH, repays flash loan, keeps ~0.568 WETH profit.
**How found:** Code review of _checkLoanIsHealthy noticing the health check uses the same collateral factor as the borrow limit, leaving zero gap between max LTV and liquidation threshold; PoC built on a mainnet fork to confirm a small swap triggers liquidation.
**Exploitation:** Attacker flash-loans WETH, dumps it into the same Uniswap pool backing the victim's LP collateral to depress its oracle value, liquidates the now-unhealthy max-leveraged position, then swaps seized assets back and repays the flash loan, netting the liquidation bonus.
**Insight:** When a lending market's borrow limit equals its liquidation threshold, a max borrow is instantly liquidatable by any oracle/pool price nudge; check whether health checks and borrow caps share the same factor and whether the collateral is an AMM LP whose price an attacker can move.