# Liquidation blocked by revert or misclassification

Liquidation paths that revert on reward transfer, misclassify transfers, or skip deficit checks

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2023-10-04. Updated 2026-11-01._

## How it works
Liquidation is supposed to be an unconditional, third-party-callable path that restores solvency. It breaks when the path depends on something the borrower controls or on a classification that is wrong. Two shapes: (1) the liquidation call performs an external token transfer to the borrower (rewards), and a hook-capable token lets the borrower revert mid-call, so the liquidation never completes [E2](https://bugbountylibrary.com/r/c4%3A2023-07-moonwell%3AM-01.md); (2) the enforcement mechanism is only triggered by third parties and is economically unattractive, so the deficit is never settled [E3](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-03.md). A related shape is a token whose transfer classification (buy vs remove) is set for a whole function body, so a transfer is treated as the wrong kind and a gate is skipped [E1](https://bugbountylibrary.com/r/dhl%3A20260911-gdc.md).

## Where it shows up
- External token transfers (safeTransfer of emission/reward tokens) inside repay/liquidate "allowed" checks or the liquidation body [E2](https://bugbountylibrary.com/r/c4%3A2023-07-moonwell%3AM-01.md)
- Emission tokens that are ERC777/ERC677 or otherwise hook-capable, paid to the borrower [E2](https://bugbountylibrary.com/r/c4%3A2023-07-moonwell%3AM-01.md)
- Penalty/incentive mechanisms (forceReplenish) that only third parties trigger, with a break-even threshold [E3](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-03.md)
- repay() that does not require a zero deficit [E3](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-03.md)
- Token gates using extcodesize only; state flags (swapping, isRemove) set for a whole function body [E1](https://bugbountylibrary.com/r/dhl%3A20260911-gdc.md)
- Transfers classified by counterparty rather than by actual operation [E1](https://bugbountylibrary.com/r/dhl%3A20260911-gdc.md)

## How to review
Trace every external call and token transfer in the liquidation/repay path and ask: can the party being liquidated influence whether this call succeeds? The invariant: a liquidation of an undercollateralized position must succeed (or fail only for reasons outside the borrower's control) regardless of borrower behavior, including token hooks. For incentive-driven settlement, check that the incentive always exceeds the cost of triggering it, or that settlement is enforced on repay/exit. For token gates, check that classification reflects the real operation, not just the counterparty address.

## Variants seen
- ERC777 emission token hook reverts liquidation, blocking it and accruing bad debt [E2](https://bugbountylibrary.com/r/c4%3A2023-07-moonwell%3AM-01.md)
- Dust-sized collateral surplus makes replenishment unprofitable; deficit grows unbounded [E3](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-03.md)
- Pair-to-address transfer misclassified as remove, skipping a buy restriction [E1](https://bugbountylibrary.com/r/dhl%3A20260911-gdc.md)

## Impact and severity
Blocked liquidation accrues bad debt (high) [E2](https://bugbountylibrary.com/r/c4%3A2023-07-moonwell%3AM-01.md); indefinite interest-free borrowing with unsettled deficit (medium) [E3](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-03.md); misclassification enabled a pair drain (high) [E1](https://bugbountylibrary.com/r/dhl%3A20260911-gdc.md). Severity rises when the borrower controls the revert and when no fallback settlement exists.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260911-gdc.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-07-moonwell%3AM-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-03.md