# Liquidator can take all collateral and underlying tokens for a fraction of the correct price

Liquidation payout used per-token debt share ratio instead of total debt ratio, letting a liquidator repay the smallest debt and seize all collateral.

- Payout: Contest reward
- Severity: high
- Program: Blueberry
- Credited: cducrest-brainbot
- Disclosed: 2023-02-01
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-02-blueberry-judging/issues/127
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AH-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** BlueBerryBank liquidate() lending contract
**Root cause:** liqSize/uTokenSize/uVaultShare are computed as collateral * (share/oldShare) where share/oldShare is the fraction of a single debt token repaid, not the fraction of the position's total debt.
**Steps:**
1. User deposits 1mm DAI, borrows $950k ETH and $50k ICHI (11.8k ICHI); both go into ETH-ICHI pool as one collateral token.
2. Prices crash 25%, position becomes liquidatable (worth $750k).
3. Liquidator calls `liquidate()` repaying the full ICHI debt (11.8k ICHI, ~$37.5k).
4. repayInternal returns share == oldShare for ICHI, so `liqSize = pos.collateralSize * share / oldShare` equals the entire collateralSize.
5. Same for uTokenSize and uVaultShare: liquidator receives all DAI and all LP tokens.
**How found:** Code review of liquidation math: noticed share/oldShare is scoped to one debtToken's shares but applied to the whole position's collateral and underlying balances.
**Exploitation:** Attacker waits for a multi-debt position to become liquidatable, repays only the smallest debt token in full so share/oldShare == 1, and receives 100% of collateral and underlying vault shares for a fraction of their value.
**Insight:** In multi-asset debt positions, verify that liquidation payout ratios are normalized against total debt value, not per-token share; repaying the smallest debt token in full makes any per-token ratio equal 1.