# liquidateDefaultedLoanWithIncentive sends the collateral to the wrong account

Teller's liquidateDefaultedLoanWithIncentive sends collateral to the lender instead of the liquidator, removing liquidation incentive and causing accounting errors.

- Payout: Contest reward
- Severity: high
- Program: Teller
- Credited: 0x3b
- Disclosed: 2024-04-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/46
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high technique:source-review vuln:business-logic vuln:liquidation

**Target:** LenderCommitmentGroup_Smart contract
**Root cause:** lenderCloseLoanWithRecipient ignores the _collateralRecipient parameter and calls lenderClaimCollateral, which sends collateral to the lender (LCG) instead of the liquidator.
**Steps:**
1. Call liquidateDefaultedLoanWithIncentive on a defaulted loan.
2. The function calls lenderCloseLoanWithRecipient with the liquidator as recipient.
3. lenderCloseLoanWithRecipient ignores the recipient and calls lenderClaimCollateral.
4. Collateral is transferred to the lender (LCG), not the liquidator.
**How found:** Code review identified that the _collateralRecipient parameter in _lenderCloseLoanWithRecipient is never used, and the function directly calls lenderClaimCollateral.
**Exploitation:** A liquidator repays the defaulted loan's debt expecting to receive collateral, but the collateral goes to the lender, resulting in no profit for the liquidator.
**Insight:** In liquidation functions, verify that the collateral recipient parameter is actually used in the transfer; unused parameters often indicate a bug.