# Liquidation payout worsens borrower health

Liquidation reward, fee or settlement math that debits the borrower or lowers health instead of improving it

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2026-03-09. Updated 2026-10-24._

## How it works
Liquidation should leave a borrower healthier: debt falls, and collateral falls by less than the debt repaid plus the intended incentive. The assumption that breaks is that every payout, bonus, fee and settlement return value is measured against the right base. When a reward is sized from a gross figure, a "remainder" cap includes the base it should exclude, or a settlement function returns an amount computed before fees are deducted, the borrower or pool is charged more than the debt reduction justifies. Health factor C/D then falls after liquidation instead of rising.

## Where it shows up
- Reward or bonus sized from a returned amount (netPaid, tokenPaid) computed before commission/fee burn [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-07.md).
- A cap on a "remainder" or "excess" expressed as a ratio that already contains the 100% base (e.g. 130% CR) [E2](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-03.md).
- Profit/loss arguments passed to a pool where the callee uses else-if, so profit and loss cannot both apply; bad-debt paths derive repaidAmount and profit from the wrong field [E1](https://bugbountylibrary.com/r/c4%3A2024-10-loopfi%3AH-02.md).
- Debt-increasing functions (forceReplenish) capping new debt at collateral value while ignoring incentive and fee [E4](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-10.md).

## How to review
State the invariant explicitly: after any liquidation, health factor must strictly increase, and total value removed from the borrower must not exceed debt repaid plus the intended incentive. Then check each term:
- Is the reward base net of fees actually charged? Trace the return value of settlement/burn functions to where the bonus is computed; confirm whether the returned amount is computed before or after the commission burn [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-07.md).
- Does a cap on excess subtract the base (crLiquidation - 100%)? [E2](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-03.md)
- Are profit and loss passed as separate, correctly derived values, and does the callee apply both rather than else-if? [E1](https://bugbountylibrary.com/r/c4%3A2024-10-loopfi%3AH-02.md)
- Does every debt-increasing path re-check the health factor including incentive and fee outflows? [E4](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-10.md)
Use differential scenarios across two collateral ratios or two debt levels to confirm the cap or bonus actually binds as intended.

## Variants seen
- Bad-debt liquidation passing debt as repaidAmount and misderived profit, with else-if dropping loss [E1](https://bugbountylibrary.com/r/c4%3A2024-10-loopfi%3AH-02.md).
- Remainder cap using full liquidation CR instead of the excess over 100%, so the cap never binds and high-CR borrowers overpay fees [E2](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-03.md).
- Settlement return excluding burned commission, understating netPaid and inflating the liquidator bonus [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-07.md).
- Debt cap ignoring incentive and fee, so liquidation lowers health factor [E4](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-10.md).

## Why fixes fail
E1 shows a prior fix (2024-07 H-12) that corrected only part of the path: the caller's argument semantics and the callee's else-if branch both needed changing, and the incomplete fix left loss overstated and treasury shares over-burned.

## Impact and severity
High: excess treasury share burn and mischarged lpETH stakers [E1](https://bugbountylibrary.com/r/c4%3A2024-10-loopfi%3AH-02.md), borrowers losing more to protocol fees [E2](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-03.md), inflated liquidator bonuses draining PLPs [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-07.md), and cascading liquidations with a reported path to profitable self-liquidation [E4](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-10.md). Severity rises when the mispricing is repeatable and self-triggerable.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-10-loopfi%3AH-02.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-07.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-10.md