# Last Trove Stuck After Shutdown

After branch shutdown, closeTrove's _requireMoreThanOneTroveInSystem check reverts, trapping the last trove owner's collateral in the protocol forever.

- Payout: Contest reward
- Severity: medium
- Program: Liquity
- Credited: Cosine
- Disclosed: 2025-06-05
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_liquity_april2025.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Aliquity_april2025%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** BorrowerOperations.closeTrove / trove exit logic
**Root cause:** closeTrove enforces _requireMoreThanOneTroveInSystem (needed for reward accounting), but shutdown blocks new troves, so the final remaining trove can never exit.
**Steps:**
1. Open a trove via `borrowerOperations.openTrove(...)` as ALICE.
2. Drop Chainlink price so branch TCR < SCR and call `borrowerOperations.shutdown()`.
3. Call `borrowerOperations.closeTrove(troveId)` as ALICE.
4. Observe revert `OnlyOneTroveLeft()` — collateral permanently locked.
**How found:** Reviewer reasoned that shutdown forbids new troves, so the invariant 'always more than one trove' assumed by the reward-calculation check breaks, then wrote a Foundry PoC to confirm the revert.
**Exploitation:** Not an attacker-driven exploit; a user whose trove is last after shutdown cannot withdraw collateral, causing permanent fund lock for that user.
**Insight:** When a guard enforces an invariant for accounting reasons, check whether protocol state transitions (shutdown, pause, freeze) can violate that invariant and trap the last user; test exit paths under emergency modes.