# Incorrect liquidation reward computation causes excess liquidator rewards to be given

Liquidator reward in BigBang/Singularity computed from borrow part excluding accrued interest, overpaying liquidators and shortchanging the protocol.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: peakbolt
- Disclosed: 2023-11-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1165
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-21
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:liquidation vuln:reward-distribution

**Target:** BigBang/Singularity lending markets liquidation logic
**Root cause:** _getCallerReward is passed userBorrowPart[user] (principal only) instead of the debt including accumulated interest (userBorrowPart * totalBorrow.elastic / totalBorrow.base), inconsistent with solvency checks that use elastic debt.
**Steps:**
1. Deposit WETH collateral and borrow USDO at ~74% LTV via BigBang.
2. Time-travel 100 days to accrue interest, then drop USD0/WETH oracle price and updateExchangeRate.
3. Call liquidate([user],[borrowPart],swapper,swapData).
4. Observe callerReward computed from userBorrowPart is higher than reward computed from interest-inclusive debt.
**How found:** Noticed _getCallerReward used userBorrowPart[user] while _isSolvent uses totalBorrow.elastic (interest-inclusive debt); reasoned that the dynamic incentive curve decreasing toward 100% LTV means a smaller input yields a larger reward, then confirmed via console.log comparison in a Foundry/Hardhat test.
**Exploitation:** Liquidator triggers liquidation of an underwater position; because reward percentage is derived from a smaller (fee-excluded) borrowed value, the dynamic incentive curve yields a larger reward than warranted, extracting excess value from the protocol.
**Insight:** When a reward/incentive is a function of debt or TVL, check every call site uses the same interest-inclusive (elastic) debt basis as solvency math; a monotonic-decreasing incentive curve amplifies any understated input into overpayment.