# Users can bypass auction mechanism for `LenderCommitmentGroup_Smart` liquidation mechanism for loans that are close to end of loan

Anyone can repay a near-end-of-loan defaulted bid to zero out amountOwed, then liquidate at 1x instead of the 8x auction price, seizing collateral cheaply.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: pkqs90
- Disclosed: 2024-04-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/289
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-17
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** LenderCommitmentGroup_Smart liquidation / TellerV2 repayLoanFullWithoutCollateralWithdraw
**Root cause:** calculateNextDueDate clamps dueDate to endOfLoan, so repaying a near-maturity defaulted loan does not reset its default timestamp; amountOwed becomes zero while the loan remains liquidatable.
**Steps:**
1. Identify a defaulted bid in LenderCommitmentGroup_Smart close to endOfLoan.
2. Call `TellerV2#repayLoanFullWithoutCollateralWithdraw(_bidId)` to make amountOwed zero; due date stays clamped to endOfLoan so default persists.
3. Call `liquidateDefaultedLoanWithIncentive(_bidId, 0)`; minAmountDifference computed from amountDue=0 passes.
4. Contract transfers 0 tokens and calls `lenderCloseLoanWithRecipient` to hand collateral to caller.
**How found:** Code reading of getLoanDefaultTimestamp/calculateNextDueDate clamping logic combined with liquidateDefaultedLoanWithIncentive's reliance on getAmountOwedForBid, noticing repay does not move the default timestamp near end of loan.
**Exploitation:** Attacker repays the outstanding principal (1x) then immediately liquidates with _tokenAmountDifference=0, receiving the collateral without paying the 8x auction premium; profitable when collateral value exceeds amountOwed.
**Escalation:** Race between repayer and auction participants when collateral price rises; anyone (not just borrower) can front-run the auction.
**Insight:** When a timestamp is clamped to a fixed end date, state-changing actions (repay) stop affecting time-derived checks; look for liquidation/penalty logic keyed on such clamped timestamps where zeroing the owed amount skips the incentive calculation.