# Lender force Loan become default

Cooler.repay() transfers debt tokens directly to lender; if lender is blacklisted by the debt token (e.g. USDC), repay reverts forever and the loan defaults, letting the lender seize collateral.

- Payout: Contest reward
- Severity: high
- Program: Cooler
- Credited: hansfriese
- Disclosed: 2023-01-16
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-cooler-judging/issues/23
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-cooler%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Cooler.sol repay() lending contract
**Root cause:** repay() pushes debt tokens straight to loan.lender via debt.transferFrom; a lender address on the debt token's blacklist makes every repay revert, so the borrower can never reclaim collateral.
**Steps:**
1. Alice calls `request()` for 2000 USDC debt against ETH collateral, duration 1 month
2. Bob calls `clear()` on loanID 1, becoming lender
3. Bob transfers lender role to jack (or is himself) who is on USDC blacklist via `approve`/`transfer`
4. Before expiry Alice calls `repay(1, amount)`; `debt.transferFrom(msg.sender, loan.lender, repaid)` reverts because lender is blacklisted
5. Loan expires; lender calls `defaulted(1)` and takes the ETH collateral
**How found:** Code reading of repay(): noticed debt tokens are transferred directly to the lender rather than escrowed, and reasoned that any lender-side transfer failure (blacklist) permanently blocks repayment.
**Exploitation:** Lender deliberately uses a blacklisted address (or becomes blacklisted) as loan.lender; borrower's repay() always reverts, loan expires, lender calls defaulted() to seize collateral.
**Insight:** When a contract pushes tokens to a counterparty, consider counterparty-side transfer restrictions (blacklists, pausable/hook tokens) as a griefing vector that can force default and collateral seizure; escrow-then-withdraw avoids it.