# Settled collateral of a borrower aren't available for lenders until borrower's debt is fully cleared

Ajna ERC721Pool.settle() skips _rebalanceTokens when borrower debt remains, leaving settled collateral ids locked and unavailable for lender withdrawal.

- Payout: Contest reward
- Severity: medium
- Program: Ajna
- Credited: hyh
- Disclosed: 2022-12-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-ajna-judging/issues/104
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ERC721Pool.settle() / Auctions.settlePoolDebt()
**Root cause:** settle() only calls _rebalanceTokens when t0DebtRemaining == 0, so when partial settlement removes borrower collateral ids they are never added to bucketTokenIds, leaving them unaccounted.
**Steps:**
1. Borrower defaults with ERC721 collateral; auction settles partially, removing some token ids from borrower.
2. settlePoolDebt returns t0DebtRemaining > 0 (e.g. bucketDepth exhausted or no reserves/deposits).
3. ERC721Pool.settle() sees t0DebtRemaining != 0 and skips _rebalanceTokens.
4. Removed collateral ids never enter bucketTokenIds; lender withdrawal reverts extracting token ids from bucketTokenIds.
**How found:** Code reading of settle() flow: noticed _rebalanceTokens gated on t0DebtRemaining == 0 while settlePoolDebt can remove collateral ids even when debt remains.
**Exploitation:** No attacker action; occurs naturally on partial settlement when borrower debt remains, freezing settled collateral ids from LP withdrawal, potentially permanently if no reserves/deposits exist to fully settle.
**Insight:** When a settlement/auction function returns both remaining debt and remaining collateral, check that collateral bookkeeping (id rebalancing) is keyed on collateral change, not on full debt clearance.