# _calculateMaxBorrowCollateral calculates repay incorrectly and can lead to set token liquidation

AaveLeverageStrategyExtension applied unutilizedLeveragePercentage to netRepayLimit, so once borrowValue exceeded liquidationThreshold*(1-unutilizedLeveragePercentage) all repayments reverted, blocking rebalance and forcing liquidation.

- Payout: Contest reward
- Severity: high
- Program: Index
- Credited: 0x52
- Disclosed: 2023-05-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-05-Index-judging/issues/254
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-Index%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:liquidation

**Target:** AaveLeverageStrategyExtension smart contract (_calculateMaxBorrowCollateral)
**Root cause:** netRepayLimit is computed as collateralValue * liquidationThreshold * (1 - unutilizedLeveragePercentage); subtracting borrowValue from this reduced limit underflows/reverts once borrowValue exceeds it, so repay calculations always revert.
**Steps:**
1. Set leverage so borrowValue > collateralValue * liquidationThreshold * (1 - unutilizedLeveragePercentage).
2. Call any repay path invoking _calculateMaxBorrowCollateral.
3. Observe netRepayLimit.sub(borrowValue) reverts, blocking all repayment and rebalancing.
**How found:** Code review of _calculateMaxBorrowCollateral's else branch, noticing unutilizedLeveragePercentage wrongly applied to netRepayLimit and reasoning about the subtraction underflow at high leverage.
**Exploitation:** No direct theft; high leverage causes repay calls to revert, preventing rebalance and leaving the set token to be liquidated.
**Insight:** In leverage/rebalancing math, check that safety-margin adjustments aren't applied to the repay ceiling itself; a margin subtracted from the max limit can make the repay path revert exactly when leverage is highest and repayment is most needed.