# In CreditLine#_borrowTokensToLiquidate, oracle is used wrong way

CreditLine._borrowTokensToLiquidate queried the price oracle with borrow/collateral instead of the inverse, mispricing liquidations so liquidators or lenders lose/gain funds.

- Payout: Audit contest
- Severity: high
- Program: Sublime
- Found by: 0x0x0x
- Disclosed: 2022-02-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-sublime-findings/issues/155
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:liquidation vuln:oracle-manipulation

**Target:** CreditLine.sol liquidation price oracle call
**Root cause:** getLatestPrice was called with (_borrowAsset, _collateralAsset) but the ratio needed is the inverse, so the price ratio used in liquidation math is flipped.
**Steps:**
1. Read CreditLine.sol#L1050: `(uint256 _ratioOfPrices, uint256 _decimals) = IPriceOracle(priceOracle).getLatestPrice(_borrowAsset, _collateralAsset);`
2. Observe the liquidation logic expects collateral/borrow ratio, not borrow/collateral
3. Call liquidate on an underwater line and note the mispriced ratio yields wrong borrowTokensToLiquidate
4. Fix: swap args to `getLatestPrice(_collateralAsset, _borrowAsset)`
**How found:** Code review of the liquidation path spotted the oracle argument order did not match the intended collateral/borrow ratio semantics.
**Exploitation:** A liquidator (or lender) calls liquidate; because the oracle ratio is inverted, the computed amount of borrow tokens to liquidate is wrong, letting the caller gain or lose funds at the counterparty's expense.
**Insight:** In lending/liquidation code, always verify oracle pair argument order matches the ratio direction the math assumes; a swapped pair silently inverts every liquidation payout.