# Liquidity Imbalance Exploit in Jigsaw-Pendle Integration Leading to Unliquidatable Debt

Attacker builds a large balanced Pendle LP share via Jigsaw, then the position cannot be unwound due to Pendle's MarketProportionTooHigh revert, blocking liquidation and minting bad debt.

- Payout: Contest reward
- Severity: medium
- Program: Jigsaw
- Credited: CAUsr
- Disclosed: 2025-08-11
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_jigsaw_june2025.pdf#3.2.6
- Library page: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.6
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** PendleStrategyV2.sol / Pendle market LP integration
**Root cause:** Jigsaw's addLiquiditySingleToken/removeLiquiditySingleToken usage lets an attacker accumulate a large balanced share of a Pendle market; unwinding requires swapExactPtForSy which reverts with MarketProportionTooHigh, so _claimInvestment and liquidation cannot proceed.
**Steps:**
1. Fork mainnet at block 22595148; deploy PendleStrategyV2 proxy for pufETH market 0x58612beB0e8a126735b19BB222cbC7fC2C162D2a.
2. Attacker initiates holding with 2,000 ether pufETH; holds 1,000 ether extra uSY outside.
3. Loop: `SY.transfer(YT, 500 ether); YT.mintPY(attacker, attacker)` to get PT, `PT.transfer(market, PTbalance); market.swapExactPtForSy(attacker, PTbalance, '')` to flood PT.
4. Call `strategyManager.invest` with 1,000 ether so the strategy buys back the just-deposited PT, keeping pool balanced and avoiding slippage.
5. Repeat loop until attacker owns ~52% of balanced pool.
6. Borrow max against collateral; attempt `strategyManager.claimInvestment` with 97% of shares — reverts `MarketProportionTooHigh(1.01e18, 9.6e17)` inside `swapExactPtForSy`.
7. LiquidationManager.liquidateBadDebt also cannot recover collateral; position is unliquidatable.
**How found:** Reasoned about Pendle V2 market mechanics: markets hold PT+SY, and single-token add/remove operations inherently skew the pool. Noticed that removeLiquiditySingleToken drains SY by sending PT back to the pool, and that Pendle's log-odds pricing with rateAnchor/rateScalar hits a hard MarketProportionTooHigh brake rather than slippage. Hypothesized that a large balanced LP share could be made unwithdrawable, blocking _claimInvestment and liquidation.
**Exploitation:** Attacker needs ~$5M capital. They repeatedly deposit PT directly into the Pendle market then route Jigsaw investment through the same market so the strategy's addLiquiditySingleToken buys back that PT, keeping the pool balanced and avoiding arbitrage/slippage. After acquiring a majority balanced LP share, they borrow maximally. On collateral depreciation the position cannot be liquidated because proportional withdrawal triggers Pendle's MarketProportionTooHigh brake; attacker keeps excess debt, protocol eats bad debt distributed to jUSD holders.
**Escalation:** Repeating the PT-flood/invest cycle scales pool ownership from 35% to 52%, increasing the unliquidatable portion; bad debt socialized to jUSD holders.
**Insight:** When a protocol wraps an external AMM's single-sided liquidity functions, check whether the AMM has hard imbalance reverts (not just slippage) — a balanced majority LP position can become unwithdrawable, turning collateral into unliquidatable debt. Test by forking and attempting proportional withdrawal at high pool share.