# Liquidated Troves with ICR slightly above 100% will cause a loss of funds to the Stability Pool

Troves with ICR between 100% and 100.5% get liquidated via StabilityPool, but the 0.5% collateral gas compensation creates bad debt that drains StabilityPool depositors.

- Payout: Contest reward
- Severity: medium
- Program: Bima
- Credited: santipu
- Disclosed: 2025-02-05
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_bima_december2024.pdf#3.2.6
- Library page: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.6
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity vuln:accounting-error vuln:liquidation

**Target:** Liquity-style CDP LiquidationManager / StabilityPool
**Root cause:** Liquidation routing uses ICR<100% as the bad-debt threshold, but the 0.5% collateral gas compensation deducted on liquidation means a Trove with ICR between 100% and 100.5% still produces bad debt, which is absorbed by the StabilityPool instead of the TroveManager.
**Steps:**
1. Open a Trove with collateral/debt such that ICR is e.g. 100.3% (above 100%, below 100.5%).
2. Trigger liquidation via StabilityPool path (ICR < MCR but > 100%).
3. Observe 0.5% collateral gas compensation deducted from Trove collateral, leaving debt unbacked.
4. StabilityPool depositors absorb the resulting bad debt as a loss.
**How found:** Reasoned about the interaction between the liquidation routing threshold (ICR<100% for bad-debt path) and the 0.5% collateral gas compensation, spotting that the compensation can push a slightly-healthy Trove into bad debt while still routed through the StabilityPool.
**Exploitation:** Any liquidator triggers liquidation of a Trove whose ICR sits in (100%, 100.5%); the StabilityPool offsets debt and collateral but the 0.5% gas compensation leaves a shortfall, reducing depositors' share value. Larger Troves amplify the loss.
**Escalation:** Larger Troves in the 100-100.5% ICR band cause proportionally larger StabilityPool losses, prompting withdrawals and degrading protocol health.
**Insight:** When auditing CDP/lending forks, check whether the bad-debt routing threshold accounts for all deductions (gas compensation, fees, penalties) applied during liquidation; a threshold set at exactly 100% ignores the 0.5% haircut and misroutes near-threshold liquidations.