# Incorrect calculation of lending shares in _withdrawOrAllocateSharesLiquidation can lead to revert and failure to liquidate

Wise Lending's liquidation share calculation used _maxSharePrice=false, subtracting 1 and reverting share-price validation, so liquidations failed when the pool couldn't pay out.

- Payout: Contest reward
- Severity: medium
- Program: Wise Lending
- Credited: WoolCentaur
- Disclosed: 2024-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-wise-lending-findings/issues/116
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-13
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** WiseCore._withdrawOrAllocateSharesLiquidation liquidation share math
**Root cause:** calculateLendingShares is called with _maxSharePrice=false in a withdrawal path, subtracting 1 from the share amount; this makes the post-withdraw share price exceed the pre-withdraw price and fails _compareSharePrices validation, and can underflow when the pool is 0.
**Steps:**
1. Set up a pool where the liquidator's desired receiving token is fully borrowed out (pool token balance 0).
2. Call `liquidatePartiallyFromTokens(nftIdFirst, nftIdSecond, paybackToken, receivingToken, 10)`.
3. Observe `_withdrawOrAllocateSharesLiquidation` computes `totalPoolInShares = calculateLendingShares(..., _maxSharePrice: false)` which subtracts 1.
4. The syncPool modifier's `_compareSharePrices` reverts because lendSharePriceAfter > lendSharePriceBefore.
5. Change `_maxSharePrice` to true at WiseCore.sol#L497 and the liquidation succeeds, allocating shares to the liquidator.
**How found:** Code reading of the liquidation path: noticed withdrawal functions elsewhere pass _maxSharePrice=true while this liquidation withdrawal passes false, then reasoned that subtracting 1 inflates the share price and trips the syncPool validation; confirmed with a Foundry PoC.
**Insight:** In share-based lending protocols, rounding direction must match the operation: withdrawals should round shares up (maxSharePrice=true) and deposits down. Audit every calculateLendingShares call site for the bool, especially in less-traveled liquidation paths.