# Bad debt liquidation doesn't allow liquidator to receive its ETH bonus (ante)

Aloe Borrower.liquidate forces a swap when one liability remains after bad debt, reverting and trapping the liquidator's ETH ante bonus.

- Payout: Contest reward
- Severity: medium
- Program: Aloe
- Credited: panprog
- Disclosed: 2023-10-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-10-aloe-judging/issues/42
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** Borrower.liquidate in Aloe II core lending contract
**Root cause:** After repaying available assets, a single non-zero liability sets shouldSwap=true, so liquidate attempts to transfer a token the account holds zero of, reverting. Only strain=max avoids revert but divides the ante bonus to ~0.
**Steps:**
1. Set up account with 1e18 margin0 and borrow 100e18 via modify(Action.BORROW).
2. Raise interest via _setInterest(lender0, 15000) so borrow becomes 150e18 while assets ~101e18.
3. account.warn, skip LIQUIDATION_GRACE_PERIOD, accrueInterest.
4. Call `account.liquidate(this, bytes(""), 1, (1 << 32))` — reverts on safeTransfer of missing token.
5. Call `account.liquidate(this, bytes(""), type(uint256).max, (1 << 32))` — succeeds but ante bonus ~0; remaining bad debt ~49e18 stuck.
**How found:** Code reading of Borrower.liquidate: noticed liabilities remain non-zero after min(liabilities, balance) repayment, shouldSwap becomes true, and the swap transfers an asset the account has zero balance of.
**Exploitation:** Liquidator cannot profitably liquidate a bad-debt account holding only one asset: normal strain reverts on the swap transfer, max strain forfeits the ETH ante which stays locked in the borrower contract until bad debt is repaid.
**Insight:** In liquidation logic, check the case where post-repayment liabilities are non-zero but the corresponding asset balance is zero — the swap branch assumes the account holds the other token; bad debt breaks that invariant.