# Interest rates are incorrect on Liquidation

In ParaSpace liquidation, debt tokens are transferred to the xToken before interest rates are recalculated, double-counting liquidityAdded and corrupting the liquidity rate.

- Payout: Contest reward
- Severity: high
- Program: ParaSpace
- Credited: csanuragjain
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-paraspace-findings/issues/173
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AH-03
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** LiquidationLogic._burnDebtTokens / DefaultReserveInterestRateStrategy
**Root cause:** The debt asset is transferred to the xToken before updateInterestRates runs, so calculateInterestRates reads a balance that already includes liquidityAdded and adds it again, inflating availableLiquidity.
**Steps:**
1. Liquidator calls `executeLiquidateERC20` on a position with health factor <1
2. `_burnDebtTokens` executes `IERC20(liquidationAsset).safeTransferFrom(payer, xTokenAddress, actualLiquidationAmount)`
3. Then calls `liquidationAssetReserve.updateInterestRates(cache, asset, actualLiquidationAmount, 0)`
4. `calculateInterestRates` computes `availableLiquidity = IToken(reserve).balanceOf(xToken) + liquidityAdded - liquidityTaken`, but balanceOf already includes the transfer
5. Result: availableLiquidity = (xTokenBefore + liquidityAdded) + liquidityAdded, inflating supplyUsageRatio and currentLiquidityRate
**How found:** Code reading of the liquidation flow: noticed the safeTransferFrom to xToken precedes updateInterestRates, and that calculateInterestRates reads xToken balanceOf plus liquidityAdded, causing double counting.
**Exploitation:** Any liquidator triggers a liquidation; the inflated availableLiquidity skews the liquidity rate, mispricing suppliers/borrowers on every liquidation.
**Insight:** When a rate/accounting function reads a token balance via balanceOf, check whether any transfer into that address already happened earlier in the same call path — the added-liquidity parameter then double counts.