# Vault owner is incetivized to not switch invalid collateral token, during liquidation

Invalid collateral token shifts liquidation burden to the pool, letting agents dodge switching tokens and pay ~65% instead of ~115%.

- Payout: Contest reward
- Severity: medium
- Program: Flare
- Credited: rvierdiiev
- Disclosed: 2025-11-27
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-flare-fasset#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-flare-fasset%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** LiquidationPaymentStrategy.sol asset manager liquidation logic
**Root cause:** When a vault's collateral token is invalidated by governance, liquidation charges the entire payment to the collateral pool instead of applying vaultFactor to the vault, capping vault liability at half the pool's responsibility.
**Steps:**
1. Governance invalidates a collateral token used by an agent vault.
2. Agent leaves the invalid token in place instead of switching.
3. Liquidation triggers: pool covers full payment; vault liability capped at half of pool responsibility.
4. Compare: valid token => vault pays 100% vaultFactor + half of 30% poolFactor (~115%); invalid => vault effective share ~65%.
5. Agent profits by delaying the switch.
**How found:** Code review of LiquidationPaymentStrategy.sol lines 37-39, comparing vaultFactor/poolFactor payout math between valid and invalid collateral token branches to spot the incentive misalignment.
**Exploitation:** Agent strategically avoids switching to a valid collateral token so that during liquidation the pool absorbs the payment and the vault's effective responsibility drops to ~65% instead of ~115%, reducing the agent's loss.
**Insight:** When governance can invalidate an asset, check every branch that special-cases the invalid state for payout math divergence — the fallback path often shifts liability and creates a profitable inaction for the party who should migrate.