# Griefing attack is possible via TrueFi borrowing

Attacker borrows from TrueFi pool right before a Sherlock user's redeemNFT, depressing liquidValue and inflating exit penalty, then repays.

- Payout: Contest reward
- Severity: medium
- Program: Sherlock
- Credited: hyh
- Disclosed: 2022-09-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-09-sherlock-judging/tree/main/017-M
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-sherlock%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained vuln:business-logic

**Target:** TrueFiStrategy _balanceOf / TrueFiPool2 liquidValue
**Root cause:** TrueFiStrategy NAV via _balanceOf depends on TrueFiPool2 liquidValue, which any whitelisted borrower can transiently reduce via borrow(), raising liquidExitPenalty applied to withdrawals.
**Steps:**
1. Become whitelisted borrower via FixedTermLoanAgency.allowBorrower (owner) or LineOfCreditAgency
2. Observe victim's redeemNFT()/arbRestake() in mempool
3. Front-run with `borrow(pool, amount, term, maxApy)` on FixedTermLoanAgency to drain pool liquidity
4. Victim's redeemNFT computes _balanceOf with low liquidValue and high liquidExitPenalty(totalAmount), reducing payout
5. Back-run with repay() to restore liquidity; repeat across users
**How found:** Noticed TrueFiStrategy NAV depends on TrueFi liquidity state mutable by any eligible TrueFi borrower, then reasoned a borrow/repay sandwich around redeemNFT could manipulate the exit penalty.
**Exploitation:** Attacker sandwiches victim withdrawal: borrow large amount from TrueFiPool2 to depress liquidValue, victim redeems at inflated exit penalty, attacker repays loan paying only short-term interest plus gas.
**Escalation:** Repeat across many Sherlock users; larger budget allows bigger/more frequent loans moving liquidity further.
**Insight:** When a strategy's share price reads an external pool's instantaneous liquidity, check whether any permissionless actor (e.g. whitelisted borrowers) can transiently move that liquidity to manipulate entry/exit penalties.