# Liquidation paths skipping position checks

Settlement paths that move funds without re-checking position size, LTV, or in-progress liquidation status

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2023-10-26. Updated 2026-10-24._

## How it works
A liquidation or close path assumes it only runs against a genuinely liquidatable, frozen position. The bug is that the path settles value while skipping the checks that make that assumption true: it does not re-verify position size, collateral/LTV, or whether a related action is mid-liquidation. A derived guard (e.g. `closable == 0`) is treated as proof of safety, but it can be zero for reasons unrelated to safety (pending orders), or the guard is simply absent on one entrypoint. Balances then move on stale or unvalidated state and bookkeeping drifts from reality.

## Where it shows up
- A liquidation branch that bypasses the normal position/collateral checks ("protected" update path).
- Guards expressed as a single derived flag rather than the underlying invariant; the flag can be satisfied while the unsafe condition still holds.
- Sibling functions where one has a guard (`_revertIfAuctionClearable`, liquidation-status check) and another touching the same accounting does not.
- Multi-step liquidation flows where partyB/partyA actions can run between steps.

## How to review
For every path that moves collateral, debt, shares or balances, check the exact invariant: *before any settlement, position size, collateral/LTV and liquidation status are re-validated, and no related action can mutate the same accounting while a liquidation is in progress.* Enumerate all entrypoints touching the same buckets and confirm each enforces the same guard. Verify derived flags cannot be satisfied while the unsafe condition still holds.

## Variants seen
- Liquidation invariant only checks `closable==0`, which pending orders can satisfy while still increasing position [E1](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-1.md).
- `deallocateForPartyB`/`transferAllocation` lack partyA-liquidation checks, allowing drain mid-liquidation [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-8.md).
- `mergeOrRemoveCollateral` omits the auction-clearable guard its sibling enforces [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-7.md).

## Impact and severity
High: theft of all market/protocol funds [E1](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-1.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-8.md), mispriced LP shares [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-7.md). Severity rises when the skipped check gates fund movement and when multiple steps let state change between validation and settlement.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-1.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-8.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-7.md