# Stale collateral ratio in liquidation paths

Check every path that computes collateral, debt or CR for stale prices, wrong base, or omitted PnL.

_Area: DeFi accounting and math bugs. Seen in 9 disclosed reports; latest 2025-07-15. Updated 2026-10-23._

## How it works
A protocol computes a collateral ratio (CR) or debt value from inputs that are stale, incomplete, or measured against the wrong base. The assumption that breaks: that the CR used in a cleanup, cancel, liquidation or cross-chain path equals the CR the protocol actually holds. When the stored order price, a cached ratio, a raw collateral figure, or a partial debt formula is reused, the computed value diverges from reality, and the gap becomes free value or a mispriced liquidation.

## Where it shows up
- Cancel/cleanup paths that top a record up to a minimum size using the order's stored price and CR instead of current oracle price and asset config [E2](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-03.md).
- Functions that mint debt against a CR below 1, or let another function withdraw the collateral that was meant to back an invariant [E1](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-04.md).
- Cross-chain messages that forward raw collateral but drop existing debt, so the receiver validates against the wrong capacity [E3](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-6.md).
- A "remainder" or "excess" cap computed against a ratio that already includes the base (130% instead of 30%) [E4](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-03.md).
- Shared validation applied to branches it does not fit, e.g. a CR check on borrowed-token withdrawal [E5](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AM-10.md).
- Collateral locked with one formula and freed by recomputing it later from mutable price or ratio [E6](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.6.md).
- One entry point enforcing a stricter limit (LTV) while another path only checks the weaker one (LT) [E7](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.3.md).
- Debt value formulas that omit a term the integrated protocol includes, such as realized PnL [E8](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-6.md).

## How to review
For each path that computes CR, debt or collateral, identify every input and ask whether it is current and complete. The invariant: the value used to gate an action must equal the value the protocol would compute from current oracle price, current config, and full debt (including realized PnL). Check that cancel/top-up paths use current price and initialCR, not stored order values [E2](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-03.md); that minted debt is backed by collateral that cannot be withdrawn first [E1](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-04.md); that cross-boundary messages carry net capacity, not raw collateral [E3](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-6.md); that caps subtract the base [E4](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-03.md); that shared validators apply only to relevant branches [E5](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AM-10.md); that lock and free use the same frozen inputs [E6](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.6.md); that all paths changing a ratio enforce the same threshold [E7](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.3.md); and that integrated debt formulas mirror the source protocol exactly [E8](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-6.md).

## Variants seen
- Stale order price/CR in cancel top-up [E2](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-03.md).
- Under-collateralized mint plus collateral drain before invariant consumption [E1](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-04.md).
- Cross-chain debt omission [E3](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-6.md).
- Base not subtracted from a cap [E4](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-03.md).
- Over-broad shared validation [E5](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AM-10.md).
- Recompute-on-free with mutable inputs [E6](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.6.md).
- Inconsistent thresholds across entry points [E7](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.3.md).
- Omitted PnL term in debt [E8](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-6.md).

## Impact and severity
Led to free DUSD minting and liquidatable positions [E1, E2], borrowing beyond capacity across chains [E3](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-6.md), excess fees and loss to borrowers [E4](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-03.md), locked user funds [E5](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AM-10.md), inability to withdraw full deposits [E6](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.6.md), loans pushed to the liquidation threshold [E7](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.3.md), and misreported debt [E8](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-6.md). Severity rises when the gap is directly monetizable (mint or borrow) and when no other check catches the divergence.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-04.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AH-03.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-6.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-03.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-06-size%3AM-10.md
- E6: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.6.md
- E7: https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.3.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-6.md