# Users could get some DOLA even if they are on liquidation position

forceReplenish() compared raw collateral value against debt, ignoring collateralFactorBps, letting undercollateralized users replenish DBR and mint more DOLA.

- Payout: Audit contest
- Severity: medium
- Program: Inverse Finance
- Found by: Ch_301
- Disclosed: 2022-12-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-10-inverse#m-12
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-12
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** Market.sol forceReplenish() collateral check
**Root cause:** forceReplenish() checks collateralValue >= debts[user] using getCollateralValueInternal(), which returns raw collateral value without applying collateralFactorBps, so the check is looser than the protocol's actual credit limit.
**Steps:**
1. User holds collateral and debt near the liquidation threshold.
2. Call `forceReplenish()` on Market.sol.
3. The check `require(collateralValue >= debts[user], "Exceeded collateral value")` passes because collateralValue is unadjusted by collateralFactorBps.
4. dueTokensAccrued[user] is covered on DBR.sol and the user receives more DOLA, pushing debt past the real credit limit.
**How found:** Warden read forceReplenish() and noticed getCollateralValueInternal() returns collateralBalance * price without the collateralFactorBps multiplier, then compared it to the debt check and realized the comparison omits the factor.
**Exploitation:** An undercollateralized user invokes forceReplenish() to have their DBR dues covered and receive additional DOLA, despite being at or past the liquidation position, creating bad debt owed to the protocol.
**Escalation:** Repeated calls or a healthy position can be pushed into liquidation after replenishment, increasing protocol bad debt.
**Insight:** When a protocol has both a raw collateral value helper and a credit-limit helper, check which one each guard uses; solvency checks that compare raw collateral to debt silently ignore the collateral factor.