# DoS on liquidations when utilization rate is high

Liquidation seizes collateral via beforeWithdraw, which reverts on InsufficientProtocolLiquidity when utilization is high, letting an attacker frontrun liquidations by withdrawing liquidity.

- Payout: Contest reward
- Severity: medium
- Program: Interest Rate Model
- Credited: santipu_
- Disclosed: 2024-04-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-interest-rate-model-judging/issues/70
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-4
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:chained technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** Lending market contract (Market.sol) liquidation/seize flow
**Root cause:** internalSeize calls beforeWithdraw, which enforces floatingBackupBorrowed + floatingDebt <= newFloatingAssets; when utilization is near max, this check reverts the entire liquidation with InsufficientProtocolLiquidity.
**Steps:**
1. Set up a market where a borrower is liquidatable (price drop).
2. Ensure market utilization is high so floating liquidity is nearly fully borrowed.
3. Liquidator calls `market.liquidate(borrower, type(uint256).max, seizeMarket)`.
4. internalSeize -> beforeWithdraw computes newFloatingAssets and reverts `InsufficientProtocolLiquidity` because floatingBackupBorrowed + floatingDebt > newFloatingAssets.
5. Attacker frontruns by withdrawing collateral liquidity from another account, raising utilization and forcing the revert.
**How found:** Code reading of the liquidation path: traced internalSeize into beforeWithdraw and noticed the liquidity check (floatingBackupBorrowed + floatingDebt > newFloatingAssets) applies to seizing collateral, which is unnecessary for liquidation and reverts when utilization is high.
**Exploitation:** Attacker deposits collateral in market A with a second account, borrows against a first account, and when liquidation looms frontruns by withdrawing the deposited liquidity from market A, pushing utilization high so the liquidator's seize reverts. Attacker keeps position unliquidated until price recovers or bad debt is socialized; cost is only gas since no deposit/withdraw fees.
**Escalation:** Attacker can withdraw maximum allowed liquidity to also block partial liquidations, and by holding collateral only in market A prevents the liquidator from seizing from another market.
**Insight:** In lending forks, check whether the seize/withdraw path reuses the same liquidity guard as user withdrawals; a liquidation should not be gated by pool liquidity since collateral seizure is not a normal withdrawal. Also check whether debt repayment is pulled before or after collateral is sent, as ordering bugs create separate DoS.