# Liquidator might end up paying much more asset than collateral received

liquidateClean in Frax doesn't cap repaid shares to available collateral, so a liquidator can overpay assets for far less collateral received.

- Payout: Contest reward
- Severity: medium
- Program: Frax Finance
- Credited: 0xA5DF
- Disclosed: 2023-01-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-frax-findings/issues/99
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** Frax lending pair liquidateClean function
**Root cause:** liquidateClean repays the full requested borrow shares without checking they are covered by available collateral plus fee, so excess repayment yields only the available collateral.
**Steps:**
1. Set up pair with borrow 16e20 and collateral 1.5x.
2. Drop oracle price to liquidation_price/4 so collateral no longer covers the loan.
3. Call `pair.addInterest()` then `pair.liquidateClean(_shares, block.timestamp, users[2])` repaying full shares.
4. Observe collateralGained equals only ~1/3 of asset paid (balanceDiff).
**How found:** Code review of liquidateClean noticing no check that repaid shares are covered by available collateral; wrote e2e test dropping price to confirm overpayment.
**Exploitation:** Liquidator (or MEV searcher ordering a repayment before a well-calculated tx) repays more shares than the collateral covers, receiving only the available collateral and losing the excess asset value.
**Escalation:** Judge noted validator/MEV ordering can insert repayment ahead of a well-calculated liquidation, causing leakage; _totalBorrow bounds overpayment.
**Insight:** In liquidation functions, verify the repaid debt is bounded by seized collateral; unbounded repay amounts create MEV-ordering overpayment leakage even when a deadline exists.