# BBLiquidation::_liquidateUser liquidator can bypass protocol fee on liquidation by returning returnedShare == borrowShare

Liquidator returns only borrowAmount after swapping seized collateral, zeroing callerShare and protocol fee while keeping the full liquidation bonus.

- Payout: Contest reward
- Severity: high
- Program: Tapioca
- Credited: cergyk
- Disclosed: 2024-02-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-tapioca-judging/issues/33
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass vuln:liquidation

**Target:** BBLiquidation._liquidateUser on BigBang/Singularity markets
**Root cause:** callerShare/protocol fee is computed from the asset amount the liquidator returns after swapping seized collateral, and the liquidator controls that return value with no slippage floor.
**Steps:**
1. Liquidate a position on BigBang/Singularity; full collateral plus liquidation bonus is sent to attacker-controlled liquidationReceiver in `_swapCollateralWithAsset`.
2. Swap seized collateral to asset off-chain/on-DEX, keeping the bonus portion.
3. Return only `borrowAmount` of asset to the market so `returnedShare == borrowShare`.
4. callerShare and protocol fee compute to zero; liquidator retains the entire liquidation bonus.
**How found:** Code reading of _liquidateUser: noticed callerShare is derived from the post-swap returned asset amount controlled by the liquidator, so returning exactly borrowAmount zeroes the fee.
**Exploitation:** Attacker acts as liquidator, receives collateral+bonus at liquidationReceiver, swaps it, and repays only borrowAmount, pocketing the bonus that would otherwise fund callerShare and protocol fee.
**Escalation:** Applies to any liquidation with no prerequisite, so fee loss is unbounded across all liquidations.
**Insight:** When a reward/fee is computed from a value the caller supplies after an external swap, check whether the caller can return the minimum needed to zero the fee while keeping the seized bonus; add a minimum-return/slippage floor.