# Borrowers can bypass the LTV threshold and open loans up to the LT

Silo's withdraw/redeem checks solvency against LT instead of LTV, letting borrowers push loans to the liquidation threshold and bypass the borrow LTV cap.

- Payout: Contest reward
- Severity: medium
- Program: Silo
- Credited: phil
- Disclosed: 2025-03-19
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_silo.pdf#3.2.3
- Library page: https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.3
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Lending protocol borrow/withdraw LTV enforcement
**Root cause:** Actions::withdraw() calls _checkSolvencyWithoutAccruingInterest() which only reverts above the liquidation threshold, whereas borrow() enforces the stricter max LTV; the two paths use inconsistent limits.
**Steps:**
1. Deposit collateral and call `borrow()` up to max LTV.
2. Call `withdraw()`/`redeem()` on remaining collateral; only `_checkSolvencyWithoutAccruingInterest()` (LT check) runs.
3. Withdraw collateral until LTV sits just below LT, exceeding the intended max LTV.
4. Position is now at the liquidation threshold, easing manipulation and bad debt.
**How found:** Code review comparing the LTV check in borrow() (_checkLTVWithoutAccruingInterest) against the weaker solvency/LT check in withdraw() (_checkSolvencyWithoutAccruingInterest), spotting the inconsistent limit between the two entry points.
**Exploitation:** Borrower opens a loan at max LTV, then withdraws collateral via withdraw()/redeem() which only enforces the LT bound, leaving the position at the liquidation threshold rather than the LTV cap.
**Escalation:** Position at LT makes price-manipulation liquidation attacks easier, leaving bad debt in the protocol.
**Insight:** When a protocol enforces a risk limit on one entry point (borrow), audit every other path that changes the same ratio (withdraw, redeem, transfer) for a weaker or different threshold check.