# Liquidators can be grifted when liquidating positions with bad debt

In Silo bad-debt liquidations, a frontrunner can seize all collateral by repaying minimal debt, leaving the honest liquidator to repay remaining debt for zero collateral.

- Payout: Contest reward
- Severity: medium
- Program: Silo
- Credited: 0xStalin
- Disclosed: 2025-03-19
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_silo.pdf#3.2.13
- Library page: https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.13
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** Silo lending market liquidation (PartialLiquidation.liquidationCall)
**Root cause:** When bad debt exists (LT>100%), any debt amount can be liquidated and debt can be repaid for zero collateral once collateral is exhausted, so a frontrunner can take all collateral while the victim's tx repays remaining debt for nothing.
**Steps:**
1. Set up WBTC/WETH Silo market; borrower deposits 100k WBTC, borrows 80k WETH.
2. Move prices so position enters bad debt (LT>100%).
3. Liquidator A computes acceptable loss (~3k USD) to clear full debt.
4. Grifter frontruns and calls `liquidationCall` repaying just enough debt (35.2 of 40 WETH) to seize all collateral.
5. Liquidator A's tx executes, repaying remaining ~10k USD debt for 0 collateral, incurring 3x intended loss.
**How found:** Reviewer read PartialLiquidationLib/ExecLib liquidationPreview and noticed the bad-debt branch allows arbitrary debt amounts and the zero-collateral branch repays debt for nothing, then reasoned about mempool ordering between liquidators.
**Exploitation:** Attacker observes a pending liquidation tx for a bad-debt position, frontruns with a partial liquidation sized to seize the entire remaining collateral, then the victim's tx repays the residual debt against zero collateral.
**Insight:** In lending protocols, audit the bad-debt/zero-collateral branches of liquidation math for asymmetry between debt repaid and collateral seized; mempool ordering lets a frontrunner capture collateral while pushing the residual loss onto a later liquidator.