# SGLLiquidation::_computeAssetAmountToSolvency, Market::_isSolvent and Market::_computeMaxBorrowableAmount may overestimate the collateral, resulting in false solvency

Market._isSolvent multiplies collateral share by precision and collateralization rate before yieldBox.toAmount, inflating collateral so a user with zero-value shares borrows 748 USDO.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: zzzitron
- Disclosed: 2023-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/915
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-45
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** BigBang/Singularity lending markets (Market.sol, SGLLiquidation.sol)
**Root cause:** Collateral value is computed as yieldBox.toAmount(collateralShare * (EXCHANGE_RATE_PRECISION/FEE_PRECISION) * collateralizationRate) instead of converting share to asset first, then applying rate; the inflated product rounds up to a nonzero amount even when the raw share converts to zero.
**Steps:**
1. Add collateral of (1e8 - 1) share via BigBang.addCollateral; yieldBox.toAmount returns 0 for that share.
2. Call BigBang.borrow with usdoBorrowVal = collateralPartInAsset/exchangeRate - 1 (748 in PoC).
3. Market._isSolvent computes yieldBox.toAmount(collateralShare * 1e13 * 75000) = 749999992500000000, treating position as solvent.
4. Borrow succeeds; userBorrowPart > 0 despite zero real collateral value.
5. Same inflated formula in _computeMaxBorrowableAmount and SGLLiquidation._computeAssetAmountToSolvency causes under-liquidation.
**How found:** Code review comparing the share-to-asset conversion order in _isSolvent/_computeMaxBorrowableAmount against the correct order in BigBang._updateBorrowAndCollateralShare; noticed precision multiplication applied before yieldBox.toAmount inflates dust shares.
**Exploitation:** Attacker adds a dust collateral share that converts to zero assets, then borrows assets against the falsely-solvent position; withdrawal yields zero collateral, leaving bad debt.
**Insight:** When a share-to-asset conversion is chained with precision/rate multipliers, check the multiplication order: applying precision before toAmount can round a zero-value share up to a nonzero asset amount, breaking solvency checks.