# defaulting doesn't change the state of the loan

CollateralManager seizes collateral on defaulted loans but never closes the loan in TellerV2, letting borrowers keep repaying and lenders capture both payment and collateral.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: Dug
- Disclosed: 2023-03-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-teller-judging/issues/317
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** CollateralManager / TellerV2 loan lifecycle contracts
**Root cause:** CollateralManager.withdraw claims collateral when tellerV2.isLoanDefaulted is true but does not update TellerV2 loan status, which remains ACCEPTED.
**Steps:**
1. Borrower takes a loan via TellerV2 with collateral deposited in CollateralManager.
2. Borrower misses payment; loan becomes defaulted per tellerV2.isLoanDefaulted.
3. Lender (or anyone) calls CollateralManager.withdraw(_bidId); branch at L254-257 sends collateral to lender via _withdraw.
4. TellerV2 loan status stays ACCEPTED; borrower can still call repay on the defaulted loan.
5. Lender front-runs a late repayment with a collateral seize to capture both payment and collateral.
**How found:** Code reading of CollateralManager.withdraw revealed the default branch only moves collateral without touching TellerV2 state, so the loan lifecycle is never closed.
**Exploitation:** Lender monitors a defaulted loan, front-runs the borrower's late repayment transaction with a CollateralManager.withdraw call to seize collateral, then still receives the repayment, extracting both collateral and principal/interest.
**Insight:** When a peripheral contract (CollateralManager) reads loan status from a core contract (TellerV2) to trigger value transfer, check whether it writes back the terminal state; any seize/liquidate path that leaves status ACCEPTED enables double-dip via front-run repayment.