# No deadline and slippage check on `takeOverDebt()` can lead to unexpected results

takeOverDebt() lacked deadline and minBorrowedAmount slippage checks, letting a concurrent lender emergency-repay shrink the position before takeover confirms, leaving taker overpaying collateral.

- Payout: Contest reward
- Severity: medium
- Program: Real Wagmi
- Credited: HHK
- Disclosed: 2023-10-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-10-real-wagmi-judging/issues/51
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-real-wagmi%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LiquidityBorrowingManager.takeOverDebt() in wagmi-leverage Solidity contract
**Root cause:** takeOverDebt() has no deadline modifier and no minBorrowedAmount parameter, so position state (loan count, borrowedAmount, missing collateral) can change between signing and confirmation without reverting.
**Steps:**
1. Call `takeOverDebt()` on a liquidatable position with 2 loans and 0.2 ETH missing collateral.
2. Before confirmation, a lender calls `repay()` with `isEmergency: true`, removing one loan (e.g. 3 of 5 ETH).
3. takeOverDebt confirms; taker repays full missing collateral but receives a smaller position than expected.
4. PoC: borrow, `time.increase(3600*25)`, emergency repay, assert `checkDailyRateCollateral` balance unchanged.
**How found:** Code review comparing takeOverDebt() against borrow()/repay() which have checkDeadline(); noticed absence of deadline and slippage guard, then reasoned through mempool race with emergency repay and wrote a PoC showing missing collateral persists after emergency repay.
**Exploitation:** A lender's emergency repay (or price movement during mempool delay) front-runs the takeover; the taker still pays the position's missing collateral but ends up with a reduced position, realizing a loss versus liquidating instead.
**Insight:** When auditing takeover/liquidation-style functions, diff their parameter guards against sibling functions (borrow/repay) — missing deadline or min-amount params on state-dependent entrypoints are a recurring slippage class, especially where emergency-repay paths mutate position size.