# Liquidation condition should not factor the liquidation reward into the premiums

Particle LAMM deducts the liquidation reward from premiums before checking the liquidation condition, so healthy liens can be liquidated prematurely.

- Payout: Contest reward
- Severity: medium
- Program: Particle Protocol
- Credited: adriro
- Disclosed: 2024-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-particle-findings/issues/51
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** ParticlePositionManager.liquidatePosition() liquidation condition
**Root cause:** Liquidation reward is subtracted from tokenFromPremium/tokenToPremium before the underwater check, so the condition compares reward-discounted premiums against owed amounts, making a lien appear underwater when it is not.
**Steps:**
1. Read `liquidatePosition()` in ParticlePositionManager.sol lines 348-368.
2. Observe liquidationRewardFrom/To computed as premium * LIQUIDATION_REWARD_FACTOR / BASIS_POINT and subtracted from closeCache.tokenFromPremium/To at lines 355-356.
3. Observe the liquidation condition at lines 362-363 compares the already-reduced premiums against tokenFromOwed/ToOwed.
4. Construct a lien where premium >= owed but premium - reward < owed; call `liquidatePosition()` and it succeeds though the position is technically healthy.
5. Note admin can change LIQUIDATION_REWARD_FACTOR, instantly shifting users' health condition.
**How found:** Code reading of the liquidation flow: noticed the reward subtraction occurs before the condition check, then reasoned that the discounted premiums are what get compared to owed amounts.
**Exploitation:** A liquidator calls liquidatePosition() on a lien whose premiums still cover owed amounts; because the reward is discounted first, the condition passes and the position is liquidated, paying the liquidator a reward at the LP/borrower's expense.
**Escalation:** Admin-controlled LIQUIDATION_REWARD_FACTOR can be raised to push many positions into the liquidatable state at once.
**Insight:** In liquidation logic, check ordering matters: any incentive/fee deducted from collateral or premium values before the solvency comparison silently tightens the liquidation threshold. Trace which variable state the health check reads versus what is later paid out.