# In over liquidation, if the liquidatee has USDC-denominated assets for sale, the liquidator can buy the assets with USDC to avoid paying USDC to the liquidatee

Jojo JUSDBank over-liquidation USDC balance check can be satisfied by buying liquidatee's USDC-denominated assets instead of paying USDC owed.

- Payout: Contest reward
- Severity: medium
- Program: Jojo
- Credited: cccz
- Disclosed: 2023-04-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-jojo-judging/issues/369
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-8
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** JUSDBank liquidation / JOJOFlashLoan callback
**Root cause:** The liquidation solvency check only verifies the liquidatee's USDC balance increased by liquidatedRemainUSDC, not that the liquidator actually transferred that USDC; any USDC inflow to the liquidatee satisfies it.
**Steps:**
1. Liquidatee has unhealthy position: 100000 JUSD debt, 60 ETH collateral, and separately sells 7 ETH for 14000 USDC on another protocol.
2. Liquidator calls over-liquidation for full 60 ETH with priceOff 5%.
3. In JOJOFlashLoan callback, liquidator sends 100000 JUSD to repay and buys the 7 ETH from liquidatee for 14000 USDC, raising liquidatee's USDC balance.
4. Liquidator sends only 14737-14000=737 USDC to liquidatee.
5. `require(balanceOf(liquidated) - primaryLiquidatedAmount >= liquidatedRemainUSDC)` passes because the 14000 USDC purchase counts toward the balance increase.
**How found:** Code review of the over-liquidation branch and the post-callback balance check; noticed the check measures liquidatee USDC balance delta rather than the liquidator's actual transfer, so any USDC inflow works.
**Exploitation:** Liquidator repays JUSD debt, acquires liquidatee's collateral, and satisfies the USDC remainder check by purchasing the liquidatee's USDC-denominated assets in the callback rather than paying the owed USDC remainder, shorting the liquidatee by the purchase amount.
**Insight:** When a liquidation invariant is enforced by checking the victim's token balance delta, look for any path that increases that balance without the liquidator paying — e.g. buying the victim's assets in the same callback.