# Potential Unjust Liquidation After Exiting Market 

Venus preSeizeHook lacks a membership check, so a liquidator can seize collateral from a market the borrower already exited, causing unjust liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Venus Protocol
- Credited: 0xcm
- Disclosed: 2023-08-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-venus-findings/issues/309
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:liquidation

**Target:** Comptroller preLiquidateHook/preSeizeHook liquidation flow
**Root cause:** preSeizeHook does not verify the borrower still has the collateral market enabled as collateral, so assets removed from the liquidity calculation via exitMarket can still be seized during liquidation.
**Steps:**
1. User supplies BTC and USDT, borrows ETH.
2. User calls exitMarket(BTC) removing BTC from collateral/liquidity calc.
3. ETH price rises so remaining USDT collateral is insufficient; shortfall appears.
4. Liquidator calls liquidateBorrow; preLiquidateHook passes (shortfall>0) and preSeizeHook allows seizing BTC despite it not being enabled collateral.
**How found:** Code review of preLiquidateHook/preSeizeHook against exitMarket semantics; noticed exitMarket docs say assets are 'disabling them as collateral' yet preSeizeHook has no membership check, unlike the intended behavior.
**Exploitation:** Liquidator repays part of the ETH borrow and seizes the borrower's BTC collateral that was no longer counted in the borrower's liquidity, profiting at the borrower's expense.
**Insight:** When a protocol lets users toggle collateral membership, audit every downstream path (liquidation, seize, heal) for a check that the asset is still enabled collateral; Compound-derived code inherits this gap.