# Collateral double count and burn on increase

Does the borrow/increase path reuse, refund or drop existing collateral, leaving debt under-backed?

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2025-02-17. Updated 2026-10-24._

## How it works
Leveraged-position code assumes that collateral already in the position keeps backing the debt while a new borrow or size increase is computed. The assumption breaks when the open/increase path either counts existing collateral again as fresh borrowing capacity, or removes it (burn/refund) while debt stays. Either way the position's real collateral no longer covers its debt, and the user sits at or past the liquidation threshold.

## Where it shows up
- Borrow-amount math that adds `_maxBorrow` derived from existing collateral on top of a new borrow [E1](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-13.md).
- Increase-position paths that burn the whole existing collateral and refund underlying to the user [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-11.md).
- Recursive borrow/swap loops where collateral is supplied at the start of each iteration but the final iteration's output is never re-supplied [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-15.md).
- Any function that both reads existing collateral for capacity and mutates collateral balances in the same call.

## How to review
Trace the collateral balance and the debt balance separately through the whole open/increase call. The invariant: after the call returns, collateral held by the position must still cover debt at the protocol's threshold, and no unit of collateral may be counted twice (once as existing backing, once as new capacity). Check the loop boundary: every borrowed asset, including the last, must end up supplied as collateral before exit [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-15.md). Check that increase paths retain, not refund, existing collateral [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-11.md).

## Variants seen
- Double count: existing collateral's max borrow added into the new borrow, silently raising leverage [E1](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-13.md).
- Burn-and-refund: increase path strips collateral and returns tokens to the user, removing the liquidation buffer [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-11.md).
- Loop boundary gap: final swapped asset left uncollateralized [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-15.md).

## Impact and severity
In all three reports the user is pushed toward or into liquidation on small price moves, despite holding collateral. Severity is high because the loss is the user's position, not a protocol accounting error, and it triggers without any attacker action beyond normal use. It worsens where leverage is recursive and the gap is at the loop edge, since the uncollateralized amount scales with position size.

## Why fixes fail
No fix evidence in the reports; treat any patch as unverified until the collateral/debt invariant above is re-checked on the increase and loop-exit paths.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-13.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-11.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-15.md