# Premature Liquidation When a Borrower Pays early

TellerV2 liquidation check uses last repayment timestamp instead of due date, letting liquidators seize collateral from borrowers who paid early.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: branch_indigo
- Disclosed: 2023-03-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-teller-judging/issues/494
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-14
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:liquidation

**Target:** TellerV2 lending contract _canLiquidateLoan
**Root cause:** Liquidation eligibility is computed from block.timestamp - liquidationDelay - lastRepaidTimestamp > bidDefaultDuration, so an early payment shifts the default window earlier than the actual due date.
**Steps:**
1. Borrower takes loan on market with 3-day payment cycle and 3-day default duration, 14-day loan.
2. Borrower makes first minimal payment 1 hour after loan issuance.
3. Next due date is day 6; 5 days after the early payment (day ~5) the repaid-timestamp-based check already flags default.
4. Liquidator calls liquidation, repays principal+interest, and claims collateral before the second payment is due.
**How found:** Code review of _canLiquidateLoan noticed the default window is anchored to lastRepaidTimestamp rather than the payment due date, making the gap dependent on borrower payment timing.
**Exploitation:** Liquidator monitors loans where borrower paid early in the cycle; once block.timestamp - liquidationDelay - lastRepaidTimestamp exceeds default duration, liquidates, repays low early-stage interest via flash loan, seizes proportional collateral, sells it in same tx to repay flash loan and profit.
**Escalation:** Not market-specific; works across multiple markets and is cheap with proportional collateral via flash loans.
**Insight:** When auditing lending/loan contracts, check whether default/liquidation windows are measured from actual due dates versus last-action timestamps; borrower-controllable timestamps let liquidators front-run the true due date.