# The stale price feed update in the _isLoanLiquidatable can cause loss of funds to thelender

Stale loan-asset oracle blocks liquidation, letting borrower self-liquidate after further collateral drop and pocket the bonus, leaving lender with bad debt.

- Payout: Contest reward
- Severity: medium
- Program: Hyperlend
- Credited: Udsen
- Disclosed: 2025-01-12
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_hyperlend_november2024.pdf#3.2.4
- Library page: https://bugbountylibrary.com/r/cantina%3Ahyperlend_november2024%3A3.2.4
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** LendingP2P.sol liquidation logic / price oracle
**Root cause:** _isLoanLiquidatable reverts on stale asset oracle price (MAX_ORACLE_PRICE_AGE check) instead of falling back, so liquidators cannot act while the loan is undercollateralized but still solvent.
**Steps:**
1. Set up loan: 24 asset (~$48k), 1.2 collateral (~$60k), 80% liquidation threshold.
2. Drop collateral price to $42k and set asset oracle price age to 2h; call `liquidateLoan(0)` -> reverts `stale asset oracle`.
3. Drop collateral further to $35k, reset asset oracle age to 0.
4. Borrower calls `liquidateLoan(0)` on own loan; receives liquidator bonus (1%) and keeps asset value.
5. Lender receives collateral minus bonus/fee, incurring ~$6,504 loss.
**How found:** Reading _isLoanLiquidatable and noticing the require on MAX_ORACLE_PRICE_AGE causes a revert rather than a fallback, then reasoning about the timing window where liquidation is blocked but the loan remains unliquidated.
**Exploitation:** Borrower waits for stale asset oracle to block third-party liquidation, then after collateral price falls below loan value, self-liquidates to capture the liquidator bonus and avoid repaying full loan value, shifting bad debt to lender.
**Insight:** When a liquidation path hard-reverts on stale oracle data, check whether the borrower can time self-liquidation after further price movement to capture the bonus; oracle staleness checks should degrade to a fallback rather than block liquidation.