# Missing solvency check on borrow paths

Entrypoints that raise debt or remove collateral without re-running the same post-action solvency/LTV check

_Area: DeFi oracles, liquidations and flash loans. Seen in 8 disclosed reports; latest 2025-10-20. Updated 2026-10-23._

## How it works
A lending or margin system assumes every action that raises debt or removes collateral leaves the account solvent. That assumption breaks when an entrypoint (borrow, withdraw, increase position, a router or connector action) does not run the same solvency/LTV check its sibling runs, or runs it against state that does not yet include the new debt. The account then holds debt above its true collateral ratio, or collateral is pulled out from under an open position. Where the evidence shows it, temporary flash-loan capital passes the check and then leaves [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-10.md)[E3](https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md)[E5](https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance.md).

## Where it shows up
- Borrow/withdraw paths calling different safety functions, so a per-collateral cap enforced on one is absent on the other [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-10.md).
- Connector/adapter wrappers where `repay` checks solvency but `borrow` does not [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-16.md).
- Routers that open a leveraged position and separately allow collateral withdrawal without re-checking [E5](https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance.md).
- `cook()`-style multicall where a REPAY action does not properly validate solvency [E6](https://bugbountylibrary.com/r/dhl%3A20251004-mimspell3.md).
- Async flows where debt/collateral is only recorded after a round-trip, so the pre-send check reads pre-borrow state [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-20.md).
- Health factor miscalculated when lend and borrow happen in one transaction [E3](https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md).
- Collateral not properly valued/validated before borrow, so a minimal deposit unlocks full-reserve borrow [E7](https://bugbountylibrary.com/r/dhl%3A20241119-polterfinance-exploit.md).
- Increase-position paths that burn and refund existing collateral, stripping the liquidation buffer [E8](https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-11.md).

## How to review
Enumerate every function that changes debt or collateral. For each, confirm it calls the same solvency/LTV routine after the state change, using current prices and post-action balances. Grep for the check names (`isSolvent`, `_isAccountSafeAfterBorrow`, `getHypotheticalAccountLiquidityCollateral`, health-factor helpers) and verify each mutating entrypoint reaches one. Invariant: after any borrow, withdraw, or position change, collateral value times LTV covers debt, and per-collateral caps hold. Diff sibling functions for asymmetric checks [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-16.md). Separate two failure modes: a missing call (grep the entrypoint) versus the same routine fed wrong inputs or stale state (trace what balances and prices it reads, and whether pending async debt is included) [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-20.md)[E3](https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md)[E7](https://bugbountylibrary.com/r/dhl%3A20241119-polterfinance-exploit.md).

## Variants seen
- Different check function on withdraw vs borrow, bypassing per-collateral caps [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-10.md)
- Async cross-chain borrow not locked before send, so the same collateral backs multiple borrows [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-20.md)
- Missing solvency call in adapter borrow [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-16.md)
- No post-action solvency in margin router [E5](https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance.md)
- Multicall REPAY action skips enforcement [E6](https://bugbountylibrary.com/r/dhl%3A20251004-mimspell3.md)
- Health factor miscalculated within one transaction [E3](https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md)
- Collateral not valued/validated, minimal deposit unlocks full-reserve borrow [E7](https://bugbountylibrary.com/r/dhl%3A20241119-polterfinance-exploit.md)
- Increase-position path refunds collateral, leaving position undercollateralized [E8](https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-11.md)

## Why fixes fail
Fixes landed on one entrypoint (repay) while the sibling (borrow) stayed unchecked [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-16.md), and checks that exist but use the wrong function or wrong values still pass [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-10.md)[E3](https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md).

## Impact and severity
Drains ranged from a single pool (60 stETH [E3](https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md)) to full reserves (1.7M [E6](https://bugbountylibrary.com/r/dhl%3A20251004-mimspell3.md), ~7M [E7](https://bugbountylibrary.com/r/dhl%3A20241119-polterfinance-exploit.md)). Critical when the gap lets an attacker borrow a reserve's full liquidity; flash-loan funding and multicall batching remove capital barriers and hide intermediate states [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-10.md)[E5](https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance.md)[E6](https://bugbountylibrary.com/r/dhl%3A20251004-mimspell3.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-20.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-10.md
- E3: https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-16.md
- E5: https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance.md
- E6: https://bugbountylibrary.com/r/dhl%3A20251004-mimspell3.md
- E7: https://bugbountylibrary.com/r/dhl%3A20241119-polterfinance-exploit.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-11.md