# Donation-inflated collateral liquidation

Health, LTV or utilization read from live balanceOf that a direct token transfer can inflate

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2026-03-15. Updated 2026-10-24._

## How it works
A protocol derives collateral value, weighted-average LTV, exchange rate, or utilization from a live token balance (`IERC20.balanceOf(position)`) instead of from tracked deposits. Any third party can raise that balance by a direct transfer (a "donation"). The inflated balance then feeds a formula that assumes balances only change through protocol actions, so the computed health, weight, or ratio no longer reflects what the user actually deposited. The victim's position is pushed into an unhealthy or mispriced state without their consent.

## Where it shows up
- Health/LTV math reading `balanceOf(address(this))` or `balanceOf(position)` rather than an internal accounting variable.
- Weighted-average LTV or per-asset weighting that uses live balances as weights [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-13.md).
- Exchange-rate or share-price calculations that divide by a live token balance [E2](https://bugbountylibrary.com/r/dhl%3A20260315-venus-the.md).
- Utilization computed from live balances that selects a branch or direction [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-6.md).
- Lending functions accepting an arbitrary borrower (borrowBehalf-style) [E2](https://bugbountylibrary.com/r/dhl%3A20260315-venus-the.md).

## How to review
The invariant: every value used in health, LTV, exchange rate, or utilization must be derived only from protocol-tracked state that external transfers cannot change. Check each formula input back to its source; if it resolves to `balanceOf`, treat it as attacker-controlled. Confirm donations either revert, are accounted separately, or cannot shift weights/direction. For borrow-on-behalf functions, confirm debt cannot be opened against a victim without their authorization; this authorization gap, not the balance math, is what makes E2 exploitable.

## Variants seen
- Donation skews weighted-average LTV, raising minReqAssetValue above totalAssetValue and making a healthy position liquidatable [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-13.md).
- Donation inflates a victim's vTHE collateral value while borrowBehalf opens debt on that victim, draining markets [E2](https://bugbountylibrary.com/r/dhl%3A20260315-venus-the.md).
- Small gift flips utilization branch so a large timeDelta is applied as a ratio increase instead of decrease, skipping recovery [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-6.md).

## Impact and severity
Healthy positions become liquidatable and collateral is seized [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-13.md); lending markets drained via victim accounts [E2](https://bugbountylibrary.com/r/dhl%3A20260315-venus-the.md); collateral ratio inflated to borrow beyond limits and drain funds [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-6.md). Severity is high where liquidation or borrowing is permissionless and the donation cost is small relative to the value extracted; arbitrary-borrower functions widen the victim set.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-13.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260315-venus-the.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-6.md