# Blacklisted creditor can block all repayment besides emergency closure

A blacklisted creditor causes the direct fee transfer in LiquidityManager to revert, blocking all loan repayment and forcing the borrower to default.

- Payout: Contest reward
- Severity: medium
- Program: Real Wagmi
- Credited: 0x52
- Disclosed: 2023-10-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-10-real-wagmi-judging/issues/83
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-real-wagmi%3AM-4
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** LiquidityManager repayment/fee-transfer logic in wagmi-leverage vault
**Root cause:** Repayment loop transfers accumulated fees directly from the vault to the creditor via transferToken; if the creditor is blacklisted for the hold token (e.g. USDC/USDT), the transfer reverts and the whole repayment reverts.
**Steps:**
1. Borrower takes a loan where the creditor (ownerOf loan.tokenId) is blacklisted for the hold token.
2. Borrower restores liquidity and calls repay; LiquidityManager computes liquidityOwnerReward and calls `Vault(VAULT_ADDRESS).transferToken(cache.holdToken, creditor, liquidityOwnerReward)`.
3. Blacklisted creditor cannot receive tokens, so transferToken reverts, reverting the entire repayment.
4. Borrower can never repay and is forced to default; LPs recover only via emergency closure after default.
**How found:** Code review of the repayment path in LiquidityManager.sol, noticing fees are pushed directly to the creditor rather than cached, and reasoning about blacklist-capable tokens like USDC/USDT.
**Exploitation:** Not an attacker-driven exploit; a griefing/DoS condition where a blacklisted creditor address makes every repayment revert, forcing borrower default and delaying LP recovery until emergency closure.
**Insight:** When a protocol pushes tokens to an external party inside a critical loop, check whether that party can be blacklisted or revert-on-receive; direct transfers to arbitrary addresses turn a recipient restriction into a protocol-wide DoS. Cache or escrow instead.