# A liquidator can gain not only collateral, but also can reduce his own debt!

Liquidating 1 wei rounds debt shares to zero, so the liquidator's own debt drops while the borrower's shares stay unchanged, shifting debt to other borrowers.

- Payout: Contest reward
- Severity: medium
- Program: Surge
- Credited: chaduke
- Disclosed: 2023-02-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-surge-judging/issues/101
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:liquidation vuln:precision-loss

**Target:** Pool.sol liquidate()
**Root cause:** tokenToShares rounds down so a 1-wei liquidation yields 0 debt shares while totalDebt is still decremented, socializing the liquidator's debt.
**Steps:**
1. Alice and Bob each borrow 1000, warp 1 year to 1200 debt each.
2. Bob loops `pool.liquidate(address(1), 1)` 200 times.
3. Each call: _shares=0, _currentTotalDebt-=1, collateralReward paid.
4. Result: Alice's shares unchanged, Bob's debt 1100, Bob gains 200 collateral.
**How found:** Reading liquidate() revealed tokenToShares rounds down; hypothesized amount!=0 could give 0 shares, confirmed with a Foundry loop PoC.
**Exploitation:** Repeated 1-wei liquidations of an underwater borrower pay out collateral each time while burning zero debt shares, reducing the liquidator's own debt at other borrowers' expense.
**Insight:** Audit every amount-to-shares conversion for rounding to zero: any state mutation keyed on amount instead of shares enables a 1-wei loop that extracts value.