# gOhm stuck forever if call claimDefaulted on Cooler directly

Calling Cooler.claimDefaulted directly on a Clearinghouse-owned loan sends defaulted gOhm to the Clearinghouse, which has no way to burn or transfer it, permanently stranding collateral.

- Payout: Contest reward
- Severity: medium
- Program: Cooler
- Credited: castle_chain
- Disclosed: 2023-08-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-08-cooler-judging/issues/46
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Cooler lending contract / Clearinghouse
**Root cause:** Cooler.claimDefaulted transfers collateral to loan.lender and calls onDefault, but Clearinghouse.onDefault is a no-op and defund() cannot handle gOhm, so collateral sent to the Clearinghouse is unrecoverable.
**Steps:**
1. Bob calls `Clearinghouse.lendToCooler` creating a loan collateralized by 1000 gOhm.
2. Bob defaults on the loan.
3. Eve calls `Cooler.claimDefaulted` directly on Bob's loan (bypassing Clearinghouse.claimDefaulted).
4. Collateral gOhm is transferred to the Clearinghouse address.
5. No function exists to burn or transfer gOhm out; `defund()` excludes gOhm, so funds are stuck.
**How found:** Code reading of Cooler.claimDefaulted and Clearinghouse.onDefault/defund revealed the collateral routing to the lender and the absence of any gOhm handling in the Clearinghouse.
**Exploitation:** Any external caller invokes Cooler.claimDefaulted on a Clearinghouse-owned loan immediately after default; collateral gOhm lands in the Clearinghouse with no recovery path, permanently locking it (and per #1 potentially stealable in the same tx).
**Insight:** When a peripheral contract can be called directly to route value to an intermediary, check whether that intermediary has any path to move or burn the received asset type; a no-op callback plus a token-specific exclusion in the withdrawal function is a stranding bug.