# Users can receive less collateral than expected from liquidations

ShortCollateral.liquidate caps collateral returned at remaining collateral, so liquidators of underwater shorts get little or no collateral for the debt they repay.

- Payout: Contest reward
- Severity: medium
- Program: Polynomial Protocol
- Credited: MiloTruck
- Disclosed: 2023-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/236
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:liquidation

**Target:** ShortCollateral.liquidate() / Exchange.liquidate()
**Root cause:** liquidate() caps totalCollateralReturned at userCollateral.amount without reverting when the cap is hit, so the liquidator repays debt but receives less collateral (or zero) than the liquidation math implies.
**Steps:**
1. Open short: amount=1e18, collateral=1e15 sUSD via `exchange.openTrade`
2. Raise base asset price 50%: `setAssetPrice(initialBaseAssetPrice * 150 / 100)`
3. user_2 calls `exchange.liquidate(positionId, shortAmount * 85 / 100)`; position left with 15% debt and 0 collateral
4. user_3 calls `exchange.liquidate(positionId, shortAmount)`; receives 0 sUSD collateral
**How found:** Code reading of liquidate() in ShortCollateral: noticed the `if (totalCollateralReturned > userCollateral.amount) totalCollateralReturned = userCollateral.amount;` clamp silently truncates payout instead of reverting; wrote a Foundry PoC with a 50% price move to force an underwater position.
**Exploitation:** Liquidator repays a short position's debt; when collateral is insufficient, the transfer is silently clamped to remaining collateral, so the liquidator eats the loss (bad-debt positions yield zero).
**Insight:** When a payout function clamps a computed amount to an available balance instead of reverting, check whether the caller still pays full consideration for the clamped value — silent truncation is a classic underpayment/bad-debt vector in liquidation and swap paths.