# _repayLoan will fail if lender is blacklisted

TellerV2._repayLoan pushes tokens directly to lender; a blacklisted lender address blocks repayment and liquidation, letting lender grief borrower collateral.

- Payout: Contest reward
- Severity: high
- Program: Teller
- Credited: T1MOH
- Disclosed: 2023-03-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-teller-judging/issues/212
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AH-4
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** TellerV2 lending contract repayment/liquidation flow
**Root cause:** _repayLoan uses safeTransferFrom to push repayment directly to the lender address; if the token blacklists that address the transfer reverts, blocking repayment and liquidation.
**Steps:**
1. Lender holds a bid whose lendingToken implements a blacklist (e.g. USDC).
2. Lender uses lenderManager to transfer the loan NFT to a blacklisted address (even one they don't control).
3. Borrower calls repayLoan / repayLoanFull / liquidation; `_repayLoan` does `safeTransferFrom(borrower, lender, paymentAmount)` which reverts.
4. Loan cannot be repaid or liquidated; it defaults and borrower cannot withdraw collateral via `withdraw`.
5. If lender controls the blacklisted address, they can later unblacklist/transfer and claim collateral.
**How found:** Code review of _repayLoan's direct safeTransferFrom to lender and getLoanLender's lenderManager indirection; noticed blacklist tokens like USDC revert on transfer to denied addresses.
**Exploitation:** Lender waits until loan is nearly repaid, transfers the loan NFT via lenderManager to a blacklisted address, causing all repayment and liquidation calls to revert; loan defaults and lender (or blacklisted-address controller) claims borrower collateral.
**Escalation:** Lender controlling the blacklisted address can selectively move the loan to/from the blacklist to time default and seize collateral.
**Insight:** When a protocol pushes tokens to a user-supplied address, check whether the token has a denylist/freeze capability and whether the recipient address is attacker-controllable via an NFT/position transfer mechanism.