# Liquidation collateral routing and accounting errors

Check liquidation recipient params are used and invalid-collateral branches charge the right vault or pool

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2025-11-27. Updated 2026-10-24._

## How it works
Liquidation assumes three things hold: the collateral goes to the party that repaid the debt, the debt is charged to the position that owns the collateral, and health is judged per isolated risk unit. Each evidence item breaks one of these. When the assumption fails, the incentive to liquidate disappears or the wrong party pays, so bad debt accumulates or a party profits from inaction.

## Where it shows up
- Liquidation functions with a recipient/`_collateralRecipient` parameter that is never read before the transfer [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-4.md).
- Health or LTV math that sums `minReqAssetValue` across all debt pools with no per-pool collateral allocation [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-16.md).
- Branches that special-case an invalidated or governance-disabled collateral token with different payout math than the valid path [E3](https://bugbountylibrary.com/r/c4%3A2025-08-flare-fasset%3AM-01.md).
- `vaultFactor`/`poolFactor` style splits where the invalid branch caps one party's liability below its share [E3](https://bugbountylibrary.com/r/c4%3A2025-08-flare-fasset%3AM-01.md).

## How to review
- For every liquidation entry point, trace the collateral transfer to its destination and confirm it equals the caller who repaid. An unused recipient parameter is a red flag [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-4.md).
- Confirm health is computed against the same unit that liquidation charges. If positions span multiple pools, verify collateral is allocated per debt pool, not aggregated [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-16.md).
- For each governance-invalidatable asset, compare payout math in the valid and invalid branches; the invariant is that the responsible vault pays its `vaultFactor` share in both [E3](https://bugbountylibrary.com/r/c4%3A2025-08-flare-fasset%3AM-01.md).
- Check that a single pool's parameter change cannot make a position liquidatable in unrelated pools [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-16.md).

## Variants seen
- Global health aggregation across pools breaks isolated-risk guarantee, letting liquidators repay from any pool [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-16.md).
- Recipient parameter ignored; collateral routed to lender instead of liquidator [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-4.md).
- Invalid-collateral branch shifts liability to the pool, making inaction profitable for the vault owner [E3](https://bugbountylibrary.com/r/c4%3A2025-08-flare-fasset%3AM-01.md).

## Impact and severity
Medium to high. E2 removes the liquidation incentive and causes accounting errors; E3 lets an owner pay ~65% instead of ~115%, incentivizing them to keep invalid collateral; E1 breaks documented risk isolation. Severity rises where the misrouting is silent (no revert) and where governance can trigger the divergent branch.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-16.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-4.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-08-flare-fasset%3AM-01.md