# Borrowers may earn auction proceeds without filling the debt shortfall

When the last-collateral auction is purchased, remaining debt is written off; a second auction's proceeds then go to the borrower instead of covering the shortfall.

- Payout: Contest reward
- Severity: high
- Program: Backed Protocol
- Credited: hihen
- Disclosed: 2023-01-31
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-12-backed-findings/issues/97
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PaprController liquidation auction (Solidity)
**Root cause:** purchaseLiquidationAuctionNFT zeroes remaining debt when isLastCollateral is true, without checking whether another auction is still ongoing; the shortfall is never recorded, so later excess is paid to the borrower.
**Steps:**
1. Borrower adds two NFTs (N-1, N-2) to one vault and calls `increaseDebt()` until liquidatable.
2. Liquidator calls `startLiquidationAuction()` on N-1; no buyer due to falling price.
3. After `liquidationAuctionMinSpacing`, call `startLiquidationAuction()` on N-2.
4. Purchase N-1 via `purchaseLiquidationAuctionNFT`; `isLastCollateral` path burns remaining debt via `_reduceDebtWithoutBurn`, shortfall not recorded.
5. Purchase N-2; `debtCached` is 0 so `_handleExcess` transfers full excess to borrower.
**How found:** Code reading of the `isLastCollateral && remaining != 0` branch in `purchaseLiquidationAuctionNFT`; noticed it zeroes debt without checking for other ongoing auctions, then built a Foundry PoC with two collaterals.
**Exploitation:** Borrower waits for a falling NFT price so the first auction goes unsold, triggers a second auction, then a purchaser buys both; the first purchase writes off the debt, and the second auction's excess is paid out to the borrower as PAPR instead of repaying the shortfall.
**Insight:** In multi-collateral liquidation designs, the 'last collateral' write-off check must also verify no other auction is in flight; otherwise debt is zeroed while collateral remains to be sold, and excess flows to the borrower.