# Liquidating users invested in Elixir strategy may be problematic

Elixir strategy's two-step cooldown withdrawal lets a borrower reset the cooldown with 1 wei, blocking liquidation and risking bad debt.

- Payout: Contest reward
- Severity: high
- Program: Jigsaw
- Credited: SpicyMeatball
- Disclosed: 2025-08-11
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_jigsaw_june2025.pdf#3.1.9
- Library page: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.9
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** stdeUSD.sol Elixir strategy cooldown/unstake withdrawal flow
**Root cause:** Elixir strategy requires a user-initiated cooldown before withdrawal, and any new cooldown call (even 1 wei) resets the timer, so liquidation cannot pull collateral while the cooldown is pending.
**Steps:**
1. User invests into Elixir strategy via strategyManager.invest and borrows against the position.
2. Price moves so position is liquidatable (isLiquidatable returns true).
3. User calls `strategy.cooldown(userHolding, 1)` to reset the cooldown timer with 1 wei of shares.
4. Liquidator calls `liquidationManager.liquidate(...)` which reverts because strategy funds are locked in cooldown.
5. Repeat cooldown poke every cooldownDuration to indefinitely prevent liquidation.
**How found:** Reviewer compared Elixir's two-step cooldown withdrawal against other staking strategies and noticed the cooldown timer resets on any new cooldown call, then reasoned that liquidation requires withdrawing from the strategy and tested poking with 1 wei.
**Exploitation:** Borrower opens a leveraged position in the Elixir strategy, then repeatedly calls cooldown with a minimal 1 wei share amount to keep resetting the cooldown timer, so the strategy cannot be unwound and the liquidation call reverts, leaving the protocol with deteriorating collateral and potential bad debt.
**Insight:** When a strategy requires a user-initiated cooldown before withdrawal, check whether the cooldown timer can be reset by anyone or with a dust amount; any reset primitive becomes a griefing/liquidation-block vector for protocols that must unwind positions.