# The whole ante balance of a user with a very small loan, who is up for liquidation can be stolen without repaying the debt

Uncapped liquidation strain in Aloe Borrower rounds repayment to zero, letting a liquidator seize a small-loan user's collateral for gas only.

- Payout: Contest reward
- Severity: medium
- Program: Aloe
- Credited: OxZ00mer
- Disclosed: 2023-10-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-10-aloe-judging/issues/146
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity vuln:business-logic vuln:liquidation vuln:precision-loss

**Target:** Borrower.sol liquidation (strain parameter)
**Root cause:** The `strain` divisor is unbounded; when strain exceeds the loan value, `liabilities0/1` divide down to 0, so the liquidator repays nothing yet still receives `address(this).balance / strain` of collateral.
**Steps:**
1. Identify an unhealthy Borrower with a tiny loan (e.g. $0.30 WBTC, 8 decimals) and collateral (e.g. $50 ETH).
2. Call liquidate with `strain = 1e3 + 1` so `div(liabilities0, strain)` and `div(liabilities1, strain)` round to 0.
3. Observe `_repay(0,0)` executes, `shouldSwap` branch skipped, and `payable(callee).transfer(address(this).balance / strain)` pays out collateral fraction.
4. Repeat to drain remaining ante balance while debt stays unpaid.
**How found:** Code review of the liquidation math: noticed `strain` is a user-supplied divisor with no cap, and that integer division of liabilities by a large strain yields zero while the collateral payout `balance / strain` remains nonzero.
**Exploitation:** Liquidator submits liquidation with strain larger than the loan value; repayment rounds to zero, no debt is repaid, but the contract transfers a fraction of its ETH balance to the liquidator. On Arbitrum low gas makes it profitable; repeated calls drain the user's ante and leave bad debt on the market.
**Insight:** When a user-supplied divisor scales both repayment and payout, check the rounding direction at extreme values: a divisor large enough to zero the debt may still leave a nonzero collateral payout, enabling free seizure.