# Liquidation DoS via 1 Wei Repayment Frontrun

Borrower frontruns liquidation by repaying 1 wei of jUSD, making the liquidator's full-debt amount exceed borrowed() and revert, blocking liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Jigsaw
- Credited: EVDoc
- Disclosed: 2025-08-11
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_jigsaw_june2025.pdf#3.2.5
- Library page: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.5
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** LiquidationManager.liquidate() / Holding repay on lending protocol
**Root cause:** liquidate() requires _jUsdAmount <= borrowed(holding); any tiny repayment by the borrower between liquidation submission and execution lowers borrowed() below the liquidator's fixed amount, reverting the tx.
**Steps:**
1. Borrower opens insolvent position with collateral and borrows near max.
2. Collateral price drops making position liquidatable.
3. Liquidator submits liquidate(user, usdc, borrowAmount, 0, calldata) for full debt.
4. Borrower frontruns with `holdingManager.repay(address(usdc), 1, true)` after approving 1 wei jUSD.
5. Liquidation reverts on `require(_jUsdAmount <= borrowed(holding), "2003")` since borrowed() decreased by 1 wei.
**How found:** Code reading of the liquidation amount check against borrowed() and reasoning that a borrower-controlled state change between submission and execution breaks the equality assumption.
**Exploitation:** Borrower monitors mempool for full-debt liquidation txs and repays 1 wei to shift borrowed() below the liquidator's amount, reverting liquidation at negligible cost and letting bad debt accumulate.
**Insight:** When a liquidation/auction function compares a caller-supplied amount against live on-chain debt state, check whether the debtor can mutate that state (even by 1 wei) between submission and execution to invalidate the comparison.