# Any borrower with bad debt can be liquidated multiple times to lock funds in the lending pair

liquidateClean leaves leftover borrower shares unadjusted, letting repeated zero-share liquidations write off pair totals and lock the lending pair.

- Payout: Contest reward
- Severity: high
- Program: Frax Finance
- Credited: panprog
- Disclosed: 2023-01-13
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-08-frax-findings/issues/102
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** FraxlendPairCore liquidateClean liquidation function
**Root cause:** Leftover shares in liquidateClean are subtracted from pair totals but not from the borrower's borrowed shares, so an insolvent borrower retains nonzero shares and can be liquidated repeatedly with _sharesToLiquidate=0.
**Steps:**
1. Alice borrows 1000 FRAX (1000 shares) against 1.5 ETH at 1 ETH=1000, Max LTV 75%
2. ETH drops to 500; collateral worth 750 vs 1000 debt, Alice insolvent
3. Liquidator calls `liquidateClean` for 800 shares, seizing all 1.5 ETH collateral
4. Alice left with 200 shares debt, 0 collateral
5. Liquidator repeatedly calls `liquidateClean` with `_sharesToLiquidate=0`; each call reduces pair totals by 200 shares
6. Pair totals approach 0, locking pool: borrowers can't repay, lenders withdraw severely reduced amounts
**How found:** Code reading of liquidateClean: noticed leftover shares subtracted from pair totals but not from user's borrowed shares, leaving insolvent borrower with nonzero shares liquidatable again.
**Exploitation:** Liquidator seizes collateral via a normal liquidateClean, then repeatedly invokes liquidateClean with zero shares to repeatedly write off the borrower's leftover bad-debt shares from pair totals, draining total asset/borrow accounting until the pair is effectively bricked.
**Escalation:** Repeated zero-share calls scale the accounting corruption until pair totals underflow/lock, harming all lenders and borrowers.
**Insight:** In liquidation logic, check that every path reducing pair-level totals also zeroes the borrower's per-user share balance; leftover bad-debt shares that persist enable repeated no-op liquidations that corrupt global accounting.