# Liquidating chaining can be achieved by liquidating token collateral with the highest collateralFactor

Liquidators can pick highest-collateralFactor collateral to receive, repeatedly re-triggering liquidation and repaying 81% of a position instead of the intended 50% cap.

- Payout: Contest reward
- Severity: medium
- Program: Wise Lending
- Credited: Draiakoo
- Disclosed: 2024-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-wise-lending-findings/issues/202
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:liquidation

**Target:** Lending protocol liquidation routine (liquidatePartiallyFromTokens)
**Root cause:** Liquidator freely chooses which collateral token to seize; taking the highest collateralFactor token lowers the position's weighted collateral fastest, keeping borrowed value above weighted value so the position stays liquidatable and the 50% cap can be chained.
**Steps:**
1. Deploy pools with collateralFactors A=0.85, B=0.65, C=0.50, D=0.70 and prices A=1, B=0.2, C=0.5, D=1 ETH.
2. Alice deposits 10 A, 50 B, 20 C (unweighted 30, weighted 20) and borrows 18.9 D.
3. Drop C price to 0.25: weighted value 17.5 < borrowed 18.9, so position is liquidatable up to 50%.
4. Bob calls `liquidatePartiallyFromTokens(6,7,token4,token1,9.0909 ether)` seizing all token A (highest CF).
5. Borrowed 9.81 still > weighted 9, so Bob calls `liquidatePartiallyFromTokens(6,7,token4,token2,2.7 ether)` then `...3.5 ether`.
6. Result: 81% of position liquidated vs 50% intended; forcing lowest-CF token first would stop after one call at 25%.
**How found:** Reading the liquidation eligibility logic in WiseSecurityHelper (50% cap vs 89% bad-debt threshold) and noticing the liquidator controls which collateral token is received, so ordering seizures by collateralFactor can keep the position liquidatable.
**Exploitation:** A liquidator holding the debt token repays debt in chunks, each time selecting the highest-collateralFactor collateral to seize, so each seizure reduces weighted collateral faster than debt, keeping the position liquidatable and extracting more collateral (and 10% fees) than the 50% cap allows.
**Escalation:** Chaining multiple liquidatePartiallyFromTokens calls in one transaction to exceed the intended 50% liquidation limit.
**Insight:** When a liquidation cap is expressed as a fraction of debt but the liquidator chooses which collateral to seize, check whether seizing high-collateralFactor assets reduces weighted collateral faster than debt, allowing repeated liquidations past the cap.