# setIncentiveSettings would be halt during a rebalance operation that gets stuck due to supply cap is reached at Aave

Aave wstETH supply cap halts rebalance mid-way, leaving twapLeverageRatio non-zero and permanently blocking setIncentiveSettings via noRebalanceInProgress.

- Payout: Contest reward
- Severity: medium
- Program: Index
- Credited: 0xGoodess
- Disclosed: 2023-05-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-05-Index-judging/issues/10
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-Index%3AM-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** AaveLeverageStrategyExtension rebalance/setIncentiveSettings
**Root cause:** rebalance caches a non-zero twapLeverageRatio before completing; if the Aave wstETH supply cap blocks further trades, the ratio never resets to zero, so the noRebalanceInProgress modifier on setIncentiveSettings stays failing.
**Steps:**
1. Observe wstETH market on Aave at supply cap.
2. Trigger rebalance requiring leverage up; first call caches new twapLeverageRatio.
3. Aave supply cap blocks subsequent borrow/supply, halting rebalance.
4. twapLeverageRatio remains non-zero; call `setIncentiveSettings(...)` reverts on `noRebalanceInProgress`.
5. Griefing variant: attacker withdraws wstETH from Aave to free cap, owner rebalances, attacker re-supplies to re-hit cap.
**How found:** Code reading of rebalance flow: noticed twapLeverageRatio is cached before completion and that setIncentiveSettings requires twapLeverageRatio==0, then reasoned about external Aave supply cap as a halt condition.
**Exploitation:** Attacker with existing wstETH Aave position withdraws to open supply vacancy, lures operator into a multi-trade rebalance that caches a non-zero twapLeverageRatio, then re-supplies to re-hit the cap, leaving the protocol stuck and setIncentiveSettings uncallable.
**Insight:** When a state variable is cached mid-operation and gates other functions via a modifier, check whether external protocol limits (supply caps, pauses) can prevent the reset path, leaving the gate permanently closed.