# Liquidation should make a borrower healthier

Inverse Finance Market liquidation can reduce a borrower's health factor, enabling cascading liquidations and profitable self-liquidation to drain DOLA.

- Payout: Audit contest
- Severity: medium
- Program: Inverse Finance
- Found by: hansfriese
- Disclosed: 2022-12-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-10-inverse#m-10
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-10
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** Market.sol lending pool (liquidate / forceReplenish)
**Root cause:** forceReplenish only caps new debt at collateral value, ignoring liquidation incentive and fee; when debt exceeds a threshold, liquidate() pays out collateral reward+fee that lowers the health factor (C/D) instead of raising it.
**Steps:**
1. Borrower debt is pushed via forceReplenish up to just under collateral value (allowed since check is only `collateralValue >= debts[user]`).
2. Call `liquidate(user, repaidDebt)` where repaidDebt <= debt * liquidationFactorBps / 10000.
3. Liquidator receives `repaidDebt * 1 ether / price` plus `liquidationIncentiveBps` bonus, and gov takes `liquidationFeeBps` from escrow.
4. Compute health factor before/after: `getCollateralValue(user)*1e18/debt` vs `/debts[user]`; after < before, so borrower is unhealthier and can be liquidated again.
**How found:** Reasoned about the health factor C/D invariant that liquidation should improve, then checked forceReplenish's debt cap and found it ignored liquidation incentive and fee, so liquidation payouts can exceed the debt reduction's health benefit.
**Exploitation:** Attacker self-liquidates repeatedly: each round repays own debt but extracts collateral reward plus incentive/fee, and the health factor keeps dropping, enabling further liquidations until DOLA is drained from the market.
**Escalation:** Repeated liquidation cycles compound the health-factor degradation into a liquidation crisis and market drain.
**Insight:** When auditing lending markets, verify that liquidation strictly improves the health factor including incentive and fee outflows, and that any debt-increasing function (forceReplenish) caps debt against collateral plus all liquidation costs, not just collateral value.