# removeCollateral miss bankrupcy logic and can make future LPs sharing losses with the current ones

Ajna's removeCollateral omits the bucket bankruptcy check present in other asset-removal functions, so a defaulted bucket never gets flagged and future LPs absorb prior losses.

- Payout: Contest reward
- Severity: high
- Program: Ajna
- Credited: hyh
- Disclosed: 2022-12-21
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-01-ajna-judging/issues/133
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LenderActions.removeCollateral in Ajna pool contracts
**Root cause:** removeCollateral updates bucket.lps and bucket.collateral without checking whether the bucket is now insolvent (zero collateral, zero deposit, nonzero LPs), so bankruptcyTime is never set and the bucket is not reset.
**Steps:**
1. Call `removeCollateral` on a bucket where `bucketCollateral <= collateralAmount_`, `bucketDeposit == 0`, and `bucketLPs != 0`.
2. Observe bucket.lps and bucket.collateral are decremented but no `BucketBankruptcy` event fires and `bucket.bankruptcyTime` stays stale.
3. A new LP deposits into the still-'solvent' bucket, inheriting the unreconciled loss.
4. Compare with `_removeMaxCollateral`/`removeQuoteToken`, which do set bankruptcyTime and zero bucket.lps in the same condition.
**How found:** Code review comparing removeCollateral against sibling asset-removal functions (_removeMaxCollateral, removeQuoteToken) that all contain the bankruptcy check, spotting the missing branch.
**Exploitation:** A lender removes collateral from an already-insolvent bucket; because bankruptcy is never recorded, subsequent depositors' funds are diluted to cover the prior shortfall, transferring value from new LPs to old ones.
**Insight:** When auditing accounting code, diff every function that mutates the same state (bucket.lps/collateral) against its siblings; a missing solvency/bankruptcy branch in one of several parallel withdrawal paths is a recurring source of LP loss-sharing bugs.