# Liquidation and reward base miscalculation

Does the number driving seizure, debt or reward equal the position's real value?

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-08-11. Updated 2026-10-25._

## How it works
Liquidation and reward logic trusts a number that does not match the real position. The code computes seizure, debt or total assets from a gross balance, a partial formula, or a bucket that was already drained, so the figure used to decide how much to take or pay diverges from what the position actually holds or owes. The broken assumption is that the accounting variable equals reality; donations, conversion slippage, omitted terms and premature bucket depletion all break it. This differs from a plain arithmetic bug: the formula may be correct in isolation, but it is fed a base that no longer reflects the position.

## Where it shows up
- Strategy deposits that pull from the contract's raw token balance instead of the accounted `collateral[account]` variable, so donated or stray tokens are tracked in `investedAmount` but never in collateral accounting; liquidation paths then read a total that never reconciled those tokens [E1](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md)
- `assets()` overrides that report gross balances while wrap/unwrap enforces a slippage bound elsewhere [E3](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.27.md)
- Separate debt buckets (earmarked) mutated before regular debt on repay paths [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.16.md)

## How to review
For each liquidation, seizure or reward computation, identify the exact base and confirm it equals the position's true value. Check that every deposit/withdraw path updates the accounted variable, not just the token balance, and that strategy deposits validate against `collateral[account]` rather than the shared balance [E1](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md). For slippage-bounded conversions, verify the reported total reflects post-slippage value, since a slash or liquidation trigger compares reported assets to supply [E3](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.27.md). For multi-bucket debt, trace every mutation path (repay, forceRepay) and confirm ordering cannot zero a bucket that gates later reductions [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.16.md). The invariant: the number driving seizure, reward or trigger must equal the position's real collateral or debt at that moment.

## Variants seen
- Donated/stray tokens invested via strategy, invisible to collateral accounting, shrinking bad-debt seizure [E1](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md)
- Earmarked debt wiped first on repay, so redemptions cut collateral without debt reduction, leaving unliquidatable CDPs [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.16.md)
- Gross asset reporting ignoring conversion slippage, so slash triggers never fire [E3](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.27.md)

## Why fixes fail
Partial fixes that correct one `assets()` override or one formula term leave sibling paths still using the wrong base: other farm implementations keep the gross-value override [E3](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.27.md), and other repay routes can still mutate the earmarked bucket out of order [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.16.md).

## Impact and severity
Undercollateralized positions escape liquidation, bad debt goes unrecovered, slashes never trigger so early exiters dodge losses, and debt is misreported. Severity is high where it blocks liquidation or loss socialization. The shared-balance and bucket-ordering cases are especially damaging because they persist silently; the bucket-ordering case can also leave CDPs uncloseable via underflow [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.16.md). (Ranking is reviewer judgment, not stated in the reports.)

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md
- E2: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.16.md
- E3: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.27.md