# Borrower-mutable state blocks liquidation

Can a borrower cheaply reset, rotate, or shrink the state a liquidation depends on?

_Area: DeFi oracles, liquidations and flash loans. Seen in 14 disclosed reports; latest 2025-08-11. Updated 2026-10-23._

## How it works
Liquidation reads state the borrower can change. A liquidator quotes an amount or targets a position ID off-chain, then submits. Before it lands, the borrower makes a tiny change — repaying dust, topping up collateral, bumping a nonce, calling a self-service action, or rotating the position — that resets a cooldown/warning timer, invalidates a signature, rotates the ID, or shifts the arithmetic so the liquidator's fixed amount no longer fits. The broken assumption: that liquidation-relevant state is stable between quote and execution and only the liquidator moves it. In practice the borrower moves it cheaply and repeatedly.

## Where it shows up
- A borrower-initiated rotate/refinance mints new position IDs and marks the old debt repaid [E1](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.1.md).
- Warning/cooldown timers reset by the guarded action itself, including self-liquidation or dust calls [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-1.md)[E5](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.9.md)[E8](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AH-05.md).
- Cooldown extension gated on a balance threshold a top-up keeps above [E4](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-03.md).
- Off-chain signatures embed a live on-chain nonce the borrower can bump [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-7.md).
- Liquidation takes an absolute repay amount checked against live, borrower-mutable debt; a 1-wei repay makes it underflow [E6](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-06.md).
- A caller-supplied amount validated against a live cap recomputed from borrower-mutable shares, reverting on excess [E7](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-08.md).

## How to review
List every piece of state a liquidation reads; ask who can mutate it and at what cost. Invariant: once a liquidation is validly initiated, no borrower action (repay, top-up, rotate, self-call, nonce bump) can invalidate it, reset its timer, or shrink the liquidable amount below what was quoted. Concretely: does rotate/refinance enforce improved collateralization and invalidate targeted IDs [E1](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.1.md)? Do health checks run after all repay AND seize/slash steps [E6](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-06.md)? Is repay arithmetic guarded by amountToRepay <= debt [E6](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-06.md)? Is a caller-supplied amount validated against a cap not recomputed from live borrower-mutable values, and clamped rather than reverted [E7](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-08.md)? Can a dust call reset a timer [E5](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.9.md)[E8](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AH-05.md)? Does a signed hash bind a nonce the borrower cannot change mid-flight [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-7.md)?

## Variants seen
- Position-ID rotation via compensate() [E1](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.1.md)
- Self-liquidation clearing warn timer [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-1.md)
- Nonce bump invalidating upnl signature [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-7.md)
- Owner top-up skipping cooldown extension [E4](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-03.md)
- 1-wei cooldown reset [E5](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.9.md)
- 1-wei repay underflow [E6](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-06.md)
- 1-share repay shrinking live max-shares cap [E7](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-08.md)
- Dust deposit resetting shared cooldown gate [E8](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AH-05.md)

## Impact and severity
Liquidation blocked indefinitely, letting bad debt accrue; or honest liquidators griefed into reverting [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-1.md). High where positions stay underwater; worse when the griefing cost is dust and repeatable each block. E7 is a medium (M-08), so scope severity accordingly.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.1.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-1.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-7.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-03.md
- E5: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.9.md
- E6: https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-06.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-08.md
- E8: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AH-05.md