# Incorrect formula used in function Market.computeClosingFactor()

Market.computeClosingFactor() used borrowPart instead of elastic amount and mismatched decimals, computing wrong liquidation amounts in BigBang._liquidateUser().

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: KIntern\_NA
- Disclosed: 2023-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1145
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-24
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:liquidation

**Target:** BigBang market liquidation logic (Market.computeClosingFactor)
**Root cause:** computeClosingFactor uses borrowPart in the numerator instead of the corresponding elastic amount, and multiplies by borrowPartDecimals/collateralPartDecimals which can differ and underflow.
**Steps:**
1. Derive solvency equation: C * collateralShare' * collateralRate/1e5 * 1e18/exchangeRate = userElastic'.
2. Substitute userElastic' = userElastic - x and collateralShare' = collateralShare - x*(1+liquidationMultiplier/1e5)*exchangeRate/1e18/C.
3. Solve for x: x = (userElastic - C*collateralShare*collateralRate/1e5*1e18/exchangeRate) / (1 - (1+liquidationMultiplier/1e5)*collateralizationRate/1e5).
4. Return totalBorrow.toBase(x, false) from computeClosingFactor.
5. Compare to current implementation which uses borrowPart and decimal multipliers, yielding wrong borrowPart/collateralShare removal in _updateBorrowAndCollateralShare().
**How found:** Code reading of _liquidateUser/_updateBorrowAndCollateralShare; algebraically derived the solvency equation and solved for the correct closing factor, then diffed against computeClosingFactor implementation.
**Exploitation:** Liquidation of an under-collateralized position removes an incorrect amount of borrowPart and collateralShare, leaving the position in a wrong state (over- or under-liquidated) after _liquidateUser().
**Insight:** When auditing liquidation math, derive the post-liquidation solvency equation symbolically and solve for the closing factor; check whether the code uses part vs elastic amounts and whether decimal scaling factors are actually consistent.