# Bad debt can be permanently blocked from being moved to backstop

Blend pool: a borrower with bad debt deposits dust collateral, blocking bad_debt() transfer to backstop and preventing liquidation, permanently stranding debt.

- Payout: Contest reward
- Severity: medium
- Program: Blend
- Credited: monrel
- Disclosed: 2025-08-13
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-02-blend-v2-audit-certora-formal-verification#m-17
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-17
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Soroban lending pool contract
**Root cause:** pool::bad_debt() panics if the position has any collateral, and there is no minimum collateral deposit; dust collateral also cannot be liquidated because new_auction() reverts when collateral_base and collateral_raw round to 0.
**Steps:**
1. Accumulate bad debt on a position via price drop and partial liquidation.
2. Deposit dust collateral (e.g. `amount: 2` of WETH) via `SupplyCollateral` request.
3. Call `pool.bad_debt(user)` — reverts with `PoolError::BadRequest` since collateral is non-empty.
4. Call `pool.new_auction(0, user, ...)` — reverts in `scale_mul_div_floor` because collateral_base and collateral_raw round to 0.
5. Debt remains stuck; only the position owner can deposit more collateral to unblock.
**How found:** Reading bad_debt.rs guard `!collateral.is_empty() || liabilities.is_empty()` and noticing no minimum deposit; then testing that new_auction() reverts on dust due to fixed-point rounding to zero in scale_mul_div_floor.
**Exploitation:** Position owner with bad debt deposits a dust amount of collateral after liquidation completes, permanently blocking bad_debt() transfer to the backstop and preventing any liquidation auction of the dust. Owner can then blackmail backstop depositors or the pool to release the debt.
**Escalation:** Attacker using a smart-contract wallet can restrict the release of debt to a ransom payment, creating a closed extortion system against backstop depositors.
**Insight:** When a state-transition guard checks 'collateral is empty', verify whether a dust deposit can satisfy the guard while being too small to liquidate — rounding-to-zero in auction math creates a permanent DoS window.