# Repayments and liquidations can be forced to revert by an attacker that repays minuscule amount of shares

Attacker repays 1 debt share so a user's full repay or self-liquidation reverts on RepayExceedsDebt/DebtChanged, blocking health recovery and enabling liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Revert Lend
- Credited: kfx
- Disclosed: 2024-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-revert-lend-findings/issues/222
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-16
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** V3Vault repay/liquidate debt-share accounting
**Root cause:** repay reverts with RepayExceedsDebt when requested shares exceed outstanding debt, and liquidate reverts with DebtChanged when debt shares changed since the caller read them; both are strict equality/upper-bound checks on a mutable value.
**Steps:**
1. Attacker holds a tiny USDC balance and approves vault.
2. Wait for interest accrual; read `debtShares = vault.loans(TEST_NFT)`.
3. Attacker frontruns with `vault.repay(TEST_NFT, 1, true)` repaying 1 share.
4. Victim's `vault.repay(TEST_NFT, debtShares, true)` reverts with `RepayExceedsDebt`.
5. Victim's self-liquidation `vault.liquidate(..., debtShares, ...)` reverts with `DebtChanged`.
6. Attacker liquidates the now-unrecoverable position.
**How found:** Code reading of repay/liquidate share checks: noticing repay reverts when shares exceed debt and liquidate reverts when debt changed, both manipulable by a 1-share repay.
**Exploitation:** MEV frontrun: attacker observes victim repay/self-liquidate tx, repays 1 share first so the victim's tx reverts on stale debt-share count; position stays unhealthy and attacker (or anyone) liquidates it.
**Insight:** Strict 'requested shares > debt' and 'debt changed' reverts on share-based debt are griefable: any third party can shift debt shares by 1 to invalidate a victim's precomputed amount. Look for repay/liquidate APIs that require exact share counts instead of accepting max and refunding.