# The amount of debt removed during liquidation may be worth more than the account's collateral

In Tapioca SGLLiquidation, liquidation computes collateralShare from borrowPart plus bonus; when it exceeds user collateral it is clamped, removing more debt than collateral is worth, leaking protocol funds.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: ItsNio
- Disclosed: 2023-11-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1620
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:liquidation

**Target:** SGLLiquidation._updateBorrowAndCollateralShare (singularity market liquidation)
**Root cause:** borrowPart is derived from collateral value via computeClosingFactor, then inflated by liquidationMultiplier to collateralShare; if collateralShare exceeds userCollateralShare it is clamped down to the user's collateral, so the debt removed (borrowPart) is worth more than the collateral actually seized.
**Steps:**
1. Set up wbtcUsdcSingularity market with WBTC asset and USDC collateral.
2. eoa1 deposits USDC collateral and borrows 74% of collateral value in WBTC, then withdraws it.
3. Drop oracle price ~40% via wbtcUsdcOracle.set and call updateExchangeRate().
4. Call liquidate([eoa1], [wbtcBorrowVal], multiSwapper, data, data).
5. Observe collateralShare computed from borrowPart+bonus exceeds userCollateralShare; add require(collateralShare <= userCollateralShare) at SGLLiquidation.sol:261 to confirm revert.
**How found:** Code reading of _updateBorrowAndCollateralShare: noticed collateralShare is clamped to userCollateralShare without reducing borrowPart correspondingly, meaning debt removed can exceed collateral value; confirmed with a Foundry/Hardhat POC adding a require to trigger the branch.
**Exploitation:** Liquidator calls liquidate on an underwater account; the contract removes borrowPart worth of debt but only seizes the user's (smaller) collateral, so the protocol absorbs the shortfall — a liquidator/borrower can extract value by positioning an account so collateralShare exceeds collateral.
**Insight:** In liquidation math, whenever a computed seize amount is clamped to the user's balance, check whether the paired debt-reduction amount is also clamped — asymmetric clamping leaks protocol funds.