# Debt write off can be prohibited by HPB depositor by continuously allocating settlement blocking dust deposits in the higher buckets

Ajna HPB depositor spams dust quote deposits into higher buckets so settlePoolDebt iterates dust and stalls, dodging bad-debt write-off while still bucketTake-ing collateral.

- Payout: Contest reward
- Severity: high
- Program: Ajna
- Credited: hyh
- Disclosed: 2023-04-20
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-04-ajna-judging/issues/110
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-ajna%3AH-6
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:dos

**Target:** ERC20 pool settlement / addQuoteToken / settlePoolDebt
**Root cause:** addQuoteToken accepts any positive amount with no dust control, and _settlePoolDebtWithDeposit iterates buckets settling only positive deposits, so many tiny deposits in high buckets exhaust bucketDepth/gas before reaching the HPB deposit.
**Steps:**
1. HPB depositor holds large quote deposit in a bucket that will absorb bad debt.
2. Call `addQuoteToken(dustAmount, highIndex, expiry)` across many high-price buckets (up to/above market price).
3. When liquidation debt exists, `settle() -> settlePoolDebt()` walks buckets via `Deposits.findIndexAndSumOfSum`, settling only dust per bucket until bucketDepth/gas runs out.
4. Direct `removeQuoteToken()` on the HPB bucket reverts via `_revertIfAuctionDebtLocked()` while debt is in auction.
5. Depositor instead calls `bucketTake()` (no debt-locked check) to convert quote to collateral, then `removeCollateral()` to extract it.
**How found:** Code reading of settlement loop: noticed `_settlePoolDebtWithDeposit` only requires `unscaledDeposit != 0` and iterates bounded bucketDepth, while addQuoteToken has no minimum, implying dust can starve iteration; cross-checked that bucketTake lacks the auction-debt-locked revert.
**Exploitation:** Depositor monitors pool, front-runs clearable state by adding dust deposits to many higher buckets; settlement agents cannot economically clear dust (gas > dust value) and HPB deposit stays frozen but recoverable via bucketTake->removeCollateral, offloading bad-debt risk to unaware depositors.
**Escalation:** Can re-add dust continuously and use moveQuoteToken from a pre-positioned low bucket to repopulate higher buckets, sustaining the block across repeated settlement attempts.
**Insight:** When a settlement/liquidation loop iterates a bounded number of price buckets and treats any nonzero balance as progress, tiny deposits in high buckets can starve it; check whether the same actor has an alternate path (here bucketTake) that bypasses the lock protecting the deposit.