# Inexpedient liquidatable logic that could have half liquidable position turns fully liquidable instantly

Polynomial's maxLiquidatableDebt halves barely-unhealthy positions, but the 10% bonus drops collateral ratio below the wipeout cutoff, making the position fully liquidatable in a second tx.

- Payout: Contest reward
- Severity: high
- Program: Polynomial Protocol
- Credited: RaymondFam
- Disclosed: 2023-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/70
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AH-14
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:liquidation

**Target:** ShortCollateral.sol liquidation logic
**Root cause:** maxLiquidatableDebt returns shortAmount/2 when 0.95e18 <= safetyRatio <= 1e18, but the 10% liquidation bonus applied to the slashed half reduces collateral ratio below the 1.235e18 full-liquidation threshold, so a second liquidation call wipes the position.
**Steps:**
1. Set collRatio=1.5e18, liqRatio=1.3e18, liqBonus=1e17 as in ShortCollateral.t.sol
2. Open a short position with collateral ratio x=1.3e18 (safetyRatio=1e18)
3. Call liquidate; maxLiquidatableDebt returns shortAmount/2, half is liquidated with 10% bonus
4. New collateral ratio = (1.3*0.45/0.5)e18 = 1.17e18 < 1.235e18
5. Call liquidate again; safetyRatio < WIPEOUT_CUTOFF so maxDebt = shortAmount, full liquidation
**How found:** Code reading of maxLiquidatableDebt's safetyRatio branches; noticed the 0.95e18 cutoff combined with the 10% bonus mathematically pushes a half-liquidated position below the full-liquidation threshold.
**Exploitation:** Liquidator calls liquidate twice in consecutive transactions on a position at the boundary; first call halves it, second call wipes it entirely, extracting the full liquidation bonus.
**Insight:** When a partial-liquidation path applies a bonus to collateral, recompute the post-liquidation ratio against the full-liquidation cutoff; boundary positions can cross the wipeout threshold in one step, turning a designed half-liquidation into a full drain.