# Liquidations can be prevented by updating the SL timeout before it expires Crit/High · Three Sigma · RWA perpetuals DEX · 19th February, 2024 Finding 3S-OS-H01 of the Ostium security review. - Protocol: https://www.ostium.com/ - Report: /reports/ostium - Source: https://cdn.sanity.io/files/qoqld077/production/a95b9c69e0f65d1d6b0e649f0d62a362358ca8ce.pdf --- ### Description Traders who continually [update](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumPairInfos.sol#L421) their [stop losses](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTrading.sol#L454-L456) before the SL timeout expires will never face liquidation. This is because liquidating via a LimitOrder of type LIQ is impossible when the limit order includes a stop loss. Additionally, triggering the stop loss with a LimitOrder of type SL is hindered by the [timeout check](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTrading.sol#L468). A PoC can be found [here](https://github.com/0xOstium/smart-contracts-threeSigma/commit/a39b9ffea1d95a39ac361e18f31903f0f3fc66f6). ### Recommendation If the trade is liquidatable, disregard the timeout for stop losses. ### Status Addressed in [#32a1701](https://github.com/0xOstium/smart-contracts-threeSigma/pull/58/commits/32a170176003301c6dbe858addfc6651a609b2ff). --- Related findings: - [Liquidations can be prevented by frontrunning and liquidating 1 debt (or more) due to wrong assumption in POS_MANAGER](https://0xsimao.com/findings/init-capital-ii-liquidations-frontrunning-debt-assumption): INIT Capital