# Liquidation seizeassets computation rounding issue

Morpho Blue rounds repaidAssets up before computing seized collateral, letting a liquidator repay 1 share repeatedly to seize all collateral and leave bad debt.

- Payout: Contest reward
- Severity: medium
- Program: Morpho Blue
- Credited: Christoph Michel
- Disclosed: 2024-09-28
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_morpho_blue_dec2023.pdf#3.2.5
- Library page: https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.5
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation vuln:precision-loss

**Target:** Morpho.sol liquidate() seizeAssets computation
**Root cause:** repaidAssets is rounded up via toAssetsUp and reused to compute seizedAssets, so a 1-share repayment seizes collateral worth the rounded-up asset amount rather than the true share value.
**Steps:**
1. Set up market with LLTV 0.75 and borrow share price ~1.01e-6 after interest.
2. Borrower supplies 4$ collateral, borrows 3e6 shares (~3.03$).
3. Nudge oracle price so borrower is slightly unhealthy.
4. Liquidator calls `morpho.liquidate(marketParams, BORROWER, 0, 1, hex"")` repeatedly with sharesToRepay=1.
5. Each call seizes ~1$ collateral while burning only 1 share of debt.
6. Loop until collateral drained; borrower left with nearly full debt as bad debt.
**How found:** Code reading of liquidate() noticed repaidAssets rounded up (toAssetsUp) is reused for seizedAssets computation, then reasoned about share-price rounding with a concrete numeric example and PoC.
**Exploitation:** Liquidator repeatedly submits minimal 1-share liquidations; each rounds repaidAssets up to a full asset unit, seizing disproportionate collateral and earning liquidation incentive, draining borrower collateral while debt shares barely decrease, leaving protocol with bad debt.
**Escalation:** Splitting into many tiny 1-share liquidations scales the rounding error to fully liquidate the position.
**Insight:** When a single rounded value feeds both the debt-reduction and collateral-seizure math, check whether rounding direction favors the liquidator; tiny 1-share liquidations amplify per-call rounding error into full collateral seizure.