# Tokens can't be removed as a collateral without breaking liquidations and other core functions

Setting a token's collateralFactor to 0 to delist it makes collateralValue zero, causing division-by-zero reverts in liquidations and loan health checks.

- Payout: Contest reward
- Severity: medium
- Program: Revert Lend
- Credited: iamandreiski
- Disclosed: 2024-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-revert-lend-findings/issues/158
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-20
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** V3Vault lending contract (setTokenConfig / liquidate / _checkLoanIsHealthy)
**Root cause:** collateralFactor doubles as the collateral whitelist; setting it to 0 zeroes collateralValue, which is used as a divisor in _calculateLiquidation and in health checks.
**Steps:**
1. Admin calls `setTokenConfig(address(USDC), 0, type(uint32).max)` to delist USDC as collateral.
2. A loan collateralized by USDC becomes unhealthy.
3. Call `liquidate()`; `_checkLoanIsHealthy` computes `collateralValue = fullValue.mulDiv(0, Q32) = 0`.
4. `_calculateLiquidation` computes `debt * fullValue / collateralValue` and reverts on division by zero.
5. Same revert occurs via `loanInfo()`; outstanding loans can never be liquidated.
**How found:** Code reading of the collateralFactor-based whitelist mechanism and tracing collateralValue through _checkLoanIsHealthy into _calculateLiquidation's division.
**Insight:** When a config value serves double duty as both a parameter and an enable/disable flag, trace every downstream use of the derived value—especially divisors—to see if the 'disabled' state (0) causes reverts that block core flows like liquidation.