# Exchange._liquidate function can cause liquidator to burn too much powerPerp tokens

Liquidator burns full debtRepaying powerPerp tokens even when ShortCollateral caps collateral returned at userCollateral.amount, causing liquidator loss.

- Payout: Contest reward
- Severity: high
- Program: Polynomial Protocol
- Credited: rbserver
- Disclosed: 2023-08-01
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/226
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** Exchange._liquidate / ShortCollateral.liquidate smart contracts
**Root cause:** ShortCollateral.liquidate caps totalCollateralReturned at userCollateral.amount when collateral price drops, but Exchange._liquidate still burns the full debtRepaying amount of powerPerp from the liquidator.
**Steps:**
1. Liquidator calls `Exchange._liquidate(positionId, 1000e18)`
2. ShortCollateral computes collateralClaim = debt.mulDivDown(markPrice, collateralPrice); with low collateralPrice, totalCollateralReturned exceeds userCollateral.amount
3. Cap sets totalCollateralReturned = userCollateral.amount (worth ~500e18 powerPerp) and transfers only that
4. Exchange then executes `powerPerp.burn(msg.sender, debtRepaying)` burning full 1000e18
5. Liquidator loses 500e18 powerPerp equivalent with no compensation
**How found:** Code reading of _liquidate flow: noticed totalCollateralReturned is capped inside ShortCollateral.liquidate but the burn amount in Exchange._liquidate uses the uncapped debtRepaying, creating a mismatch.
**Exploitation:** Liquidator is incentivized to liquidate but when collateral has crashed relative to markPrice, the cap silently reduces payout while the burn stays at debtRepaying; liquidator eats the difference.
**Insight:** When a downstream function silently caps a returned value, check every upstream consumer that assumes the uncapped amount—here the burn amount diverges from actual collateral received.