# LiquidationManager::liquidateBadDebt() will not retrieve all invested collateral from liqui- dated holding

liquidateBadDebt caps collateral retrieval at registry-recorded principal, so yield-bearing strategies beyond that amount are skipped, stranding admin funds.

- Payout: Contest reward
- Severity: high
- Program: Jigsaw
- Credited: phil
- Disclosed: 2025-08-11
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_jigsaw_june2025.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.2
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** LiquidationManager / SharesRegistry collateral accounting
**Root cause:** _retrieveCollateral breaks when holding balance >= totalCollateral, but SharesRegistry.collateral records only deposited principal, not accrued strategy yield, so the loop exits before draining all strategies.
**Steps:**
1. Admin calls `liquidateBadDebt(holding, data)` with `_data.strategies` listing multiple strategies.
2. `totalCollateral = SharesRegistry.collateral(holding)` returns principal only (e.g. 105e18 for 100e18+5e18 deposits).
3. `_retrieveCollateral` withdraws from strategy 1 yielding 110e18; holding balance 110e18 >= 105e18 triggers `break`.
4. Strategy 2 (now worth 10e18) is never withdrawn; admin loses that collateral.
**How found:** Code reading of `_retrieveCollateral`'s `useHoldingBalance` break condition versus SharesRegistry's principal-only collateral accounting; constructed a two-strategy numeric example to show the shortfall.
**Exploitation:** Admin-initiated bad-debt liquidation with multiple strategies where earlier strategies accrued yield; the early break strands remaining strategy collateral, and users without bad debt can be liquidated.
**Insight:** When a loop's exit condition compares a live token balance against an accounting value, check whether that accounting value includes accrued yield/interest — principal-only snapshots cause early exits that strand value in later iterations.