# Liquidation can be finished without calling triggerDefault() (and repossessing the loan) if pool delegate or governor call finishCollateralLiquidation(...) after impairment. Crit/High · Three Sigma · Institutional lending · 10th April, 2024 Finding 3S-MAPLE-M07 of the Maple Finance security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2024 - Source: https://cdn.sanity.io/files/qoqld077/production/36dbe5ca76da3d2392bcee581548067705b8bd36.pdf --- ### Description The usual flow is to impair a loan and then call triggerDefault() followed by finishCollateralLiquidation(); however, it's possible to call finishCollateralLiquidation() without calling triggerDefault(), leading to the collateral in the loan not being liquidated and the cover of the delegate being used. Exploit scenario ● delegate or governor impair a loan ● delegate or governor call finishCollateralLiquidation(...) without calling triggerDefault(...) first ● The liquidationInfo is deleted, the collateral in the loan is not repossessed and the cover of the delegate is used to cover the remaining losses (if available) ● principalOut in the loan manager will decrease by the principal amount ● The paymentId of the loan will not be deleted, so if the borrower decides to make a payment / close the loan at any time, and this call updates the principalOut the following 2 scenarios are possible: ○ If the loan is the only loan in the loan manager, it will revert ○ If there are more loans, it will decrease the principalOut and it can make the other loans' payments fail ### Recommendation Check if the address of the liquidator is 0 at the beginning of the finishCollateralLiquidation() function. ### Status Addressed in the following PR: https://github.com/maple-labs/fixed-term-loan-manager-private/pull/33 --- Related findings: - [Liquidations miss delegate call to swapper](https://0xsimao.com/findings/tokemak-liquidations-miss-delegate-swapper): Tokemak - [`GovernorTimelock::_call()` assembly revert block doesn't have the memory safe attribute](https://0xsimao.com/findings/maple-finance-ii-timelock-assembly-revert-attribute): Maple Governor Timelock - [triggerSendFrom() will send all the ETH in the destination chain where sendFrom() is called to the refundAddress in the LzCallParams argument](https://0xsimao.com/findings/tapioca-dao-eth-refund-params-argument): Tapioca DAO - [OstiumTrading::closeTradeMarket() and OstiumTrading::topUpCollateral() are missing pending trigger checks](https://0xsimao.com/findings/ostium-close-trade-top-collateral): Ostium