# Collateral seized before repayment

Liquidation or bid flows that release or leave collateral before the counterparty's funds are pulled or escrowed

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2025-05-22. Updated 2026-10-23._

## How it works
Liquidation and bid acceptance assume the counterparty's funds are committed before value leaves the protocol. That assumption breaks when the code releases, transfers, or leaves collateral under someone else's control before repayment is pulled or escrowed. Between those two moments the collateral can change value, be drained, or the repayment can simply fail — while the seized asset is already gone.

## Where it shows up
- Bid/submit functions that only *check* a collateral balance without transferring or escrowing it [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-12.md)
- Collateral that stays under borrower control until acceptance, especially mutable-value positions (Uniswap V3 LP NFTs, ERC-4626-style shares) [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-12.md)
- Cross-chain flows that send a seize message before pulling repayment on the source chain [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-10.md)
- `transferFrom` of liquidator funds placed after collateral seizure in `liquidate()` [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-11.md)
- Self-market liquidations where repay and seize markets coincide [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-11.md)

## How to review
Trace the ordering of value movement in every liquidation and bid path. The invariant: **no collateral is released, transferred, or left mutable until the counterparty's repayment is pulled or escrowed in the same transaction (or atomically across chains).** Check that:
- Bids escrow collateral at submission, not acceptance [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-12.md)
- Outbound seize messages are preceded by pulling/escrowing repayment [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-10.md)
- `transferFrom` of repayment happens before collateral leaves the contract [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-11.md)
- The contract holds enough assets to complete both legs when repay and seize markets are the same [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-11.md)

## Variants seen
- Bid-time gap: collateral verified but not escrowed, drained before acceptance [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-12.md)
- Cross-chain gap: seize on chainA succeeds while repayment on chainB fails [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-10.md)
- Ordering bug: repayment pulled after seizure, reverting or leaving protocol short [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-11.md)

## Why fixes fail
Evidence shows the same root cause recurring across bid, cross-chain, and same-market flows; fixing one path does not cover the others.

## Impact and severity
Lenders receive worthless collateral [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-12.md); liquidators seize collateral without paying [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-10.md); liquidations revert, blocking solvency recovery [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-11.md). Severity is high where collateral is mutable or flows are cross-chain, since the gap is exploitable and hard to observe.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-12.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-10.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-11.md