# Payback can be DoSed in the BorrowingVault, may be profitable for liquidators Medium · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-M02 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description The borrowing vault enables anyone to payback the debt of another user. Thus, attackers can frontrun a user payback transaction, payback 1 wei and stop users from paying back their debts. This would make sense for liquidators, who are incentivized to do this to liquidate users. ### Recommendation There are 2 alternatives: - Instead of reverting if the payback is bigger than the maximum, limit it to the maximum. - Only enable the user to payback its debt. ### POC https://github.com/threesigmaxyz/fuji-issues-external/blob/master/test/POC/POCPaybackDoSed.t.sol#L27 ### Status Addressed here: [Fujicracy/fuji-v2#642](https://github.com/Fujicracy/fuji-v2/pull/642) --- Related findings: - [MidnightVaultExecutor::onLiquidate forces liquidators to provide callback data and never refunds leftover loan tokens](https://0xsimao.com/findings/tenor-markets-liquidate-callback-refunds-leftover): Tenor Morpho Migrations - [Most `ManagedLeveragedVault` functions are DoSed due to bad debt check](https://0xsimao.com/findings/beraborrow-i-managed-functions-bad-debt): Beraborrow Managed Dens - [`ManagedLeveragedVault::executeWithdrawalEpoch()` incorrect ICR and DoSed withdrawals due to not accouting for fees](https://0xsimao.com/findings/beraborrow-i-withdrawal-epoch-withdrawals-fees): Beraborrow Managed Dens - [DoSed withdrawals due to `ManagedLeveragedVault::executeWithdrawalEpoch()` repaying debt above limit](https://0xsimao.com/findings/beraborrow-i-withdrawals-withdrawal-epoch-debt): Beraborrow Managed Dens