# Malicious users can frontrun closeTroveFromCollateral to cause trove owner's lost

Frontrunning closeTroveFromCollateral with a redeem shrinks trove debt, then pool price manipulation makes the owner's flash-loan swap overpay, losing collateral.

- Payout: Contest reward
- Severity: medium
- Program: Liquity
- Credited: 0x37
- Disclosed: 2025-06-05
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_liquity_april2025.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Aliquity_april2025%3A3.1.2
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Wrapper contract closeTroveFromCollateral flash-loan swap path
**Root cause:** closeTroveFromCollateral reads the trove's entire debt at execution time and swaps a fixed flashLoanAmount of collateral with no slippage bound, so debt can be reduced by a frontrun redeem and the swap price manipulated.
**Steps:**
1. Owner calls `closeTroveFromCollateral(_troveId, _flashLoanAmount)` with flashLoanAmount sized to current debt plus slippage buffer (e.g. 1.1 rETH for 2000U debt).
2. Attacker frontruns by redeeming ~1500U of the trove's debt, leaving ~500U debt and ~1.25 rETH collateral.
3. Attacker manipulates the collateral/BOLD exchange pool to raise BOLD price.
4. Owner's tx executes: fetches 500U debt, swaps full 1.1 rETH for only ~500U BOLD at the manipulated price.
5. Trove closes, ~1.25 rETH returned, 1.1 rETH repaid to flash loan; owner keeps only ~0.15 rETH instead of ~1 rETH.
**How found:** Reviewer read closeTroveFromCollateral and noticed entire debt is fetched at execution time with no slippage control on the collateral-to-BOLD swap, making it manipulable by a frontrun redeem plus pool price move.
**Exploitation:** Attacker needs capital to redeem the target trove's debt (cheaper when few troves precede it or its interest rate is low) plus capital to move the swap pool price; profit is the collateral value the owner loses on the overpriced swap.
**Insight:** In close/repay wrappers that size a flash loan from live debt, check whether debt can be mutated (redeem, interest accrual) between sizing and execution and whether the swap has a min-out bound; frontrun redeem plus AMM price push is the lever.