# If `repayLoanCallback` address doesn't implement `repayLoanCallback`  try/catch won't go into the catch and will revert the tx

A malicious lender sets loanRepaymentListener to a contract lacking repayLoanCallback, so the external call reverts before try/catch and blocks all loan repayment, forcing default and collateral seizure.

- Payout: Contest reward
- Severity: high
- Program: Teller
- Credited: EgisSecurity
- Disclosed: 2024-04-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/178
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-11
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** TellerV2 repayLoan function / loanRepaymentListener callback
**Root cause:** Solidity try/catch only catches reverts inside the called function; a call to an address with no matching function selector reverts during dispatch, outside the try scope, so the empty catch block never executes.
**Steps:**
1. Lender sets loanRepaymentListener to an address/contract that does not implement repayLoanCallback (e.g. EOA or contract without the selector).
2. Borrower calls repayLoan on TellerV2.
3. Contract executes `try ILoanRepaymentListener(loanRepaymentListener).repayLoanCallback{gas:80000}(...) {} catch {}`.
4. Call reverts at function dispatch (no matching selector), not inside the target, so catch is bypassed and the whole tx reverts.
5. Borrower cannot repay; loan defaults and lender claims collateral.
**How found:** Code review of the repayLoan callback try/catch, recognizing that Solidity try/catch does not catch reverts from calling a non-existent function on an address.
**Exploitation:** Malicious lender registers a listener address lacking repayLoanCallback; every repayLoan attempt reverts, guaranteeing borrower default and lender seizure of collateral tokens.
**Insight:** Solidity try/catch does not protect against calls to addresses lacking the target selector (or EOAs) — the revert happens in dispatch, outside the try. Any untrusted callback wrapped in try/catch with an empty catch is still a griefing vector; wrap it in a trusted adapter that performs the low-level call.