# `TARGET_HEALTH` calculation does not consider the adjust factors of the picked seize and repay markets

Exactly's liquidation TARGET_HEALTH math uses an averaged adjust factor, so picking repay/seize markets with different adjust factors yields health factors of 1.15 or 1.35 instead of target.

- Payout: Contest reward
- Severity: medium
- Program: Interest Rate Model
- Credited: 0x73696d616f
- Disclosed: 2024-04-06
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-04-interest-rate-model-judging/issues/117
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** Auditor.sol checkLiquidation / Market.liquidate
**Root cause:** The debt-to-repay and collateral-to-seize are computed from an average adjust factor across all markets, but liquidation repays/seizes in a single chosen market with its own adjust factor, so the resulting health factor deviates from TARGET_HEALTH.
**Steps:**
1. Deposit 20_000e18 DAI (adjust factor 0.8) and borrow 20_000*0.8^2 DAI.
2. Deposit 10_000e18 WETH (adjust factor 0.9) and borrow 10_000*0.9^2 WETH; health factor = 1.
3. skip(1) so health factor < 1.
4. Liquidate via `market.liquidate(ALICE, type(uint256).max, market)` in DAI market -> resulting HF ~1.3477.
5. Repeat liquidating in WETH market -> resulting HF ~1.1463.
**How found:** Code-reading of the MathPaper liquidation formula and Auditor.checkLiquidation, noticing the repay amount uses an averaged adjust factor while liquidation executes against a single market's adjust factor; validated with a Foundry PoC comparing DAI vs WETH liquidation outcomes.
**Exploitation:** Liquidator chooses the repay/seize market pair; because close factor and repay amount derive from averaged adjust factor, the realized health factor lands far from target, causing liquidator to seize too little (bad-debt risk) or too much (liquidatee loss).
**Insight:** When a protocol computes liquidation sizing from portfolio-wide averages but executes per-market, check whether per-market risk parameters (adjust/collateral factors) diverge from the average — the realized health factor will drift and can be gamed by choosing the market pair.