# LendingPair.liquidateAccount fails if tokens are lent out

LendingPair.liquidateAccount pays liquidators in underlying supply tokens that may be fully lent out, blocking all liquidations and risking insolvency.

- Payout: Audit contest
- Severity: high
- Program: Wild Credit
- Found by: cmichel
- Disclosed: 2021-08-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-07-wildcredit-findings/issues/123
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-wildcredit%3AH-03
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** LendingPair.liquidateAccount lending contract
**Root cause:** liquidateAccount transfers underlying supplyToken to the liquidator via _safeTransfer but only guarantees minReserve remains, so if most supply is borrowed the transfer reverts for insufficient balance.
**Steps:**
1. User A supplies 1000 WETH to LendingPair; User B supplies 1500 DAI and borrows ~1000 WETH, leaving only minReserve WETH in the contract.
2. WETH price drops, making User B's position undercollateralized.
3. Liquidator calls `liquidateAccount(userB)`; function attempts `_safeTransfer(IERC20(supplyToken), msg.sender, supplyOutput)` for the full supply output.
4. Contract holds less than supplyOutput WETH (only minReserve), so the transfer reverts and liquidation is impossible.
**How found:** Code review of the liquidation payout path: noticed the payout uses underlying supplyToken balance while the contract only enforces minReserve, so payout amount is not guaranteed to be available.
**Exploitation:** No direct theft; the flaw blocks liquidations whenever borrowed funds exceed available reserves, leaving bad debt uncollectable and threatening protocol solvency.
**Insight:** When auditing liquidation logic, check that the asset paid to liquidators is actually held or mintable by the contract rather than assuming pool reserves cover the payout; borrowed-out supply breaks underlying-token payouts.