# CollateralManager#commitCollateral can be called on an active loan

CollateralManager.commitCollateral lacks an active-loan check, letting a borrower add a malicious token post-acceptance that blocks liquidation and enables ransom.

- Payout: Contest reward
- Severity: high
- Program: Teller
- Credited: 0x52
- Disclosed: 2023-03-20
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-03-teller-judging/issues/168
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AH-1
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:dos

**Target:** CollateralManager smart contract (commitCollateral / escrow withdrawal)
**Root cause:** commitCollateral never verifies the bid is still pending, so collateral can be appended to an already-accepted loan; _withdraw iterates bidCollaterals and reverts if any token transfer fails.
**Steps:**
1. Borrower creates bid: 10 ETH against 50,000 USDC at 10% APR.
2. Lender fills the bid, loan becomes active.
3. Borrower calls `CollateralManager.commitCollateral(_bidId, [maliciousToken])` with a token whose transfer reverts.
4. Borrower stops repaying; loan becomes liquidatable.
5. Lender calls liquidate; `_withdraw` iterates bidCollaterals and reverts on the malicious token transfer.
6. Borrower demands ransom; enables token transfer after payment.
**How found:** Code review of commitCollateral: noticed no check that the loan is pending/not accepted, then traced bidCollaterals usage into _withdraw to see the revert-on-transfer DoS path.
**Exploitation:** Borrower adds a non-transferable/malicious ERC20 to an active loan's collateral set; liquidation and loan closure iterate all collaterals and revert on the bad token, freezing the lender's funds until the borrower toggles the token.
**Insight:** When a function mutates a list later iterated during liquidation/withdrawal, check whether it can be called after the loan is active; attacker-controlled tokens in that list turn any transfer revert into a permanent liquidation DoS.