# Leverage calculation is wrong

Vault._calculate_leverage used debt+margin as numerator instead of position value, miscomputing leverage and causing unfair liquidations or over-leveraged positions.

- Payout: Contest reward
- Severity: high
- Program: Unstoppable
- Credited: 0xDjango
- Disclosed: 2023-06-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-unstoppable-judging/issues/150
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:liquidation vuln:oracle-manipulation

**Target:** Margin DEX Vault contract (Vyper) leverage calculation
**Root cause:** _calculate_leverage uses (_debt_value + _margin_value) as the position value numerator, but debt+margin does not equal current position value when debt and position tokens have uncorrelated prices; correct numerator is _position_value.
**Steps:**
1. Read Vault.vy `_calculate_leverage(_position_value,_debt_value,_margin_value)` returning `PRECISION*(_debt_value+_margin_value)/(_position_value-_debt_value)/PRECISION`.
2. Note all three inputs come from Chainlink feeds and debt/position tokens need not be correlated.
3. Construct example: 1 ETH margin, borrow 14 ETH @2k, buy 1 BTC @30k; BTC drops to 29k while ETH stays 2k.
4. Contract computes leverage (28k+2k)/(29k-28k)=30 vs true 29k/(29k-28k)=29, skewing liquidation thresholds.
**How found:** Code review of the leverage formula; observed that debt+margin is not the position's market value and constructed a cross-asset (ETH debt / BTC position) price-movement example to show divergence from true leverage.
**Insight:** When auditing leverage/health-factor math, verify the numerator actually equals current position market value; debt+margin only equals position value if debt and collateral prices move in lockstep, which cross-asset margin positions violate.