# Liquidation bypass via close and reopen

Can a borrower exit or repay just before a liquidation cost is applied, then re-enter?

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2025-02-05. Updated 2026-10-24._

## How it works
Liquidation costs (auction price, redistributed bad debt, lost collateral buffer) are applied to whoever holds the position at the moment of liquidation. The assumption that breaks is that a position's state at liquidation time reflects the same owner who carried the risk. If a borrower can cheaply close, repay, or reopen a position around that moment, they can step out before the cost lands and step back in after, leaving the cost with others or paying far less than intended. The root cause is a missing invariant tying the position to the cost across time.

## Where it shows up
- Repay/close paths that zero `amountOwed` without resetting the default timestamp, especially when a due date is clamped to a fixed end date [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-17.md)
- Liquidation pricing keyed on a value the borrower can drive to zero before liquidation [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-17.md)
- Position-increase paths that burn and refund existing collateral instead of retaining it [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-11.md)
- Socialized costs (bad-debt redistribution, fees) applied to currently open positions with no timelock on open/close [E3](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.10.md)
- Any per-position penalty computed at an event the position owner can pre-empt

## How to review
For each liquidation cost, ask: who pays it, and can the payer change their exposure between the trigger and the charge? The property that must hold: a position cannot reduce or escape a pending liquidation cost by closing, repaying, or reopening without also settling that cost. Check that repay/close resets or preserves the timestamps and amounts the liquidation logic reads [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-17.md); that increase-position keeps existing collateral in place [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-11.md); and that open/close has a timelock or cost that prevents exit-before-redistribution and re-entry after [E3](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.10.md).

## Variants seen
- Repay near maturity zeroes owed amount but leaves loan liquidatable at a cheaper price [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-17.md)
- Increase-position refunds collateral, stripping the buffer and inviting liquidation [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-11.md)
- Close before bad-debt redistribution, reopen after, shifting debt to others [E3](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.10.md)

## Impact and severity
Medium to high: cheap collateral seizure [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-17.md), unexpected user liquidation [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-11.md), and bad debt pushed onto other borrowers [E3](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.10.md). Severity rises when the bypass is permissionless, repeatable, and the shifted cost is large relative to the attacker's stake.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-17.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-11.md
- E3: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.10.md