# Liquidation reward worsens borrower health

Liquidation payout, bonus, or fee math that lowers the borrower health factor instead of raising it

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-01-08. Updated 2026-11-02._

## How it works
Liquidation is supposed to restore a borrower's health: repay debt, seize collateral, leave the borrower better off than before. The assumption that breaks is that the *reward* paid to the liquidator is always smaller than the health improvement from the debt reduction. When the payout (bonus, fee, or leftover-collateral accounting) is computed without checking the net effect on the borrower's health factor, a liquidation can *reduce* health instead of raising it. The invariant `health_after > health_before` is silently violated.

## Where it shows up
- Liquidation functions that pay collateral reward + fee but only cap or reduce debt by a smaller amount [E3](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-10.md)
- Debt-increasing functions (e.g. `forceReplenish`) that cap new debt at collateral value while ignoring the liquidation incentive and fee [E3](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-10.md)
- Per-call bonus/fee selection (clean vs dirty fee) applied against a shared collateral pool across sequential partial liquidations [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-17.md)
- Profit/loss accounting passed from a vault to a pool where profit and loss are mutually exclusive branches (else-if) [E1](https://bugbountylibrary.com/r/c4%3A2024-10-loopfi%3AH-02.md)
- Bad-debt liquidation paths that pass `debt` as repaid amount and derive profit from debt rather than accrued interest [E1](https://bugbountylibrary.com/r/c4%3A2024-10-loopfi%3AH-02.md)

## How to review
Check the exact property: for every liquidation path, compute health factor (collateral value / debt) before and after, *including* all outflows (reward, bonus, fee, treasury shares). It must strictly increase. For debt-increasing helpers, verify the cap accounts for the incentive and fee, not just raw collateral. For per-call fees against a shared pool, model the state after N sequential partial calls and confirm the last actor still receives the promised fee [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-17.md). For vault→pool accounting, confirm profit and loss can both be nonzero and are not collapsed by an else-if [E1](https://bugbountylibrary.com/r/c4%3A2024-10-loopfi%3AH-02.md).

## How finders spotted it
- Reasoned about the health-factor invariant liquidation should improve, then checked `forceReplenish`'s debt cap and found it ignored incentive and fee [E3](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-10.md)
- Modeled balances after 50% and 90% partial liquidations and saw the last liquidator's effective bonus fall below the promised fee [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-17.md)
- Reviewed a prior fix, noticed it was incomplete (profit still from `debt`, else-if retained), and built numeric scenarios showing the share gap [E1](https://bugbountylibrary.com/r/c4%3A2024-10-loopfi%3AH-02.md)

## Variants seen
- Debt cap ignores liquidation incentive/fee, so payout exceeds debt reduction [E3](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-10.md)
- Per-call dirty fee lets early partial liquidators extract full bonus, last one absorbs loss [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-17.md)
- Profit/loss miscomputed and mutually exclusive, over-burning treasury shares [E1](https://bugbountylibrary.com/r/c4%3A2024-10-loopfi%3AH-02.md)

## Impact and severity
Cascading liquidations and profitable self-liquidation draining DOLA [E3](https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-10.md); last liquidator losses up to 50% [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-17.md); excess treasury shares burned and lpETH stakers mischarged [E1](https://bugbountylibrary.com/r/c4%3A2024-10-loopfi%3AH-02.md). Impact scales with repeated cycles and shared pools.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-10-loopfi%3AH-02.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-17.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-10.md