# Port Finance Logic Error Bugfix Review

Port Finance's max_withdraw_value formula let a borrower withdraw all collateral, self-liquidate at a high bonus, and drain $20-25M while leaving debt unpaid.

- Payout: $180,000
- Severity: critical
- Program: Port Finance
- Credited: nojob
- Disclosed: 2022-06-29
- Write-up quality: 8/10
- Original: https://immunefi.com/blog/bug-fix-reviews/port-finance-logic-error-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-port-finance-logic-error-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:solana technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Solana lending protocol Reserve/Obligation withdraw logic
**Root cause:** Obligation::max_withdraw_value computed max withdraw as deposited_value minus (borrowed_value * deposited_value / allowed_borrow_value), ignoring the withdrawn reserve's LTV, so a high-LTV reserve could be fully withdrawn while leaving the obligation liquidatable.
**Steps:**
1. Find reserve R1 with high liquidation_bonus and reserve R2 with high LTV such that R1.bonus + R2.LTV > 100%.
2. Create an obligation; deposit token T1 into R1 as collateral.
3. Deposit token T2 into R2 as collateral, with T2 value ~1000x T1 value.
4. Borrow T2 from the high-LTV reserve R2, with borrow value similar to T1 deposit value.
5. Withdraw the entire T2 deposit via max_withdraw_value, making the obligation undercollateralized/liquidatable.
6. Self-liquidate the obligation: R1's high bonus liquidates T1 collateral faster than the T2 borrow is repaid, draining T1 before debt is cleared.
**How found:** Researcher analyzed the max_withdraw_value formula and noticed it derived required_deposit_value from borrowed_value/deposited_value/allowed_borrow_value without accounting for the specific reserve's LTV of the withdrawn collateral, enabling a cross-reserve bonus/LTV mismatch.
**Exploitation:** Attacker deposits a small high-bonus collateral T1 and a large high-LTV collateral T2, borrows T2 matching T1's value, withdraws all T2 collateral to force liquidation, then self-liquidates so the bonus on T1 outpaces debt repayment, extracting the T1 collateral while leaving the T2 borrow unpaid.
**Insight:** In lending protocols, check whether withdraw math uses the withdrawn asset's own LTV/collateral factor rather than aggregate obligation ratios; cross-reserve combinations where liquidation_bonus + LTV > 100% can let a borrower self-liquidate profitably.