# BBLiquidation/SGLLiquidation::_updateBorrowAndCollateralShare liquidator can bypass bad debt handling to ensure whole liquidation reward

Liquidator sets small maxBorrowPart to force partial liquidation, bypassing bad-debt reward reduction and taking full reward while leaving protocol with bad debt.

- Payout: Contest reward
- Severity: high
- Program: Tapioca
- Credited: cergyk
- Disclosed: 2024-02-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-02-tapioca-judging/issues/32
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-2
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** BigBang/Singularity market liquidation contracts (BBLiquidation/SGLLiquidation)
**Root cause:** _updateBorrowAndCollateralShare only shrinks the liquidator reward when collateralPartInAsset < borrowAmountWithBonus, but the liquidator controls maxBorrowPart, so they can pick a repay amount small enough to always satisfy the full-reward branch.
**Steps:**
1. Identify a liquidatee whose full liquidation would incur bad debt (collateralPartInAsset < borrowAmountWithBonus).
2. Call liquidate with `maxBorrowPart` set small enough that the chosen borrowPartWithBonus is fully covered by the liquidatee's collateral.
3. Execution takes the second branch (collateralPartInAsset >= borrowAmountWithBonus), paying the liquidator the full reward.
4. Account remains undercollateralized, leaving the protocol with bad debt.
**How found:** Code reading of the bad-debt handling branch in _updateBorrowAndCollateralShare; noticed the branch condition depends on borrowAmountWithBonus which is derived from the attacker-controlled maxBorrowPart, making the protection bypassable.
**Exploitation:** Liquidator selectively repays a small borrow part so the reward-shrinking branch is never hit, collecting full liquidation bonus while the remaining position stays insolvent and becomes protocol bad debt.
**Insight:** When a safety branch compares collateral against a repay amount, check whether the caller controls that repay amount; attacker-chosen partial amounts can always satisfy the 'healthy' branch and dodge proportional penalty logic.