# Liquidators can pay less than required to completely liquidate the private collateral balance of an uncollateralized position

Liquidation percentage computed on private collateral is also applied to public balance in uncollateralized positions, letting liquidators over-withdraw and profit.

- Payout: Contest reward
- Severity: high
- Program: Wise Lending
- Credited: nonseodion
- Disclosed: 2024-05-03
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-02-wise-lending-findings/issues/33
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-04
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:liquidation

**Target:** WiseLending liquidation logic (_calculateReceiveAmount / calculateWishPercentage)
**Root cause:** calculateWishPercentage uses only private collateral as denominator for uncollateralized positions, but _calculateReceiveAmount applies that percentage to both private and normal shares, deducting extra from the private balance.
**Steps:**
1. Alice deposits 50 WETH normal + 50 WETH pure, uncollateralizes, borrows WBTC against pure collateral.
2. WBTC price rises making position liquidatable.
3. Liquidator calls `liquidatePartiallyFromTokens(aliceNft, charlesNft, wbtc, WETH, paybackShares*40e16/1e18)`.
4. Percentage computed against pure collateral is applied to normal shares too, producing potentialPureExtraCashout deducted from pure balance.
5. Liquidator receives ~2x the value paid.
**How found:** Code reading of getFullCollateralETH returning early for uncollateralized positions, then tracing how calculateWishPercentage's denominator (pure collateral only) is reused in _calculateReceiveAmount against both pure and normal shares.
**Exploitation:** Liquidator partially liquidates an uncollateralized position; the wish percentage derived from pure collateral is applied to the user's normal shares, and the resulting extra cashout is subtracted from the private balance and paid to the liquidator, so they pay for only a fraction of what they receive.
**Insight:** When a percentage is computed against one denominator (pure collateral) but applied to multiple balances (pure + normal shares), check every place the percentage is reused for mismatched bases; uncollateralized/isolated-margin modes are prime spots for such denominator drift.