# Liquidation accounting leaves debt and collateral inconsistent

Liquidation paths that clamp, cap, or partially fill without reconciling debt and collateral totals

_Area: DeFi oracles, liquidations and flash loans. Seen in 4 disclosed reports; latest 2026-02-05. Updated 2026-10-30._

## How it works
Liquidation math computes a seize amount and a debt-reduction amount, then adjusts pair-level totals and per-user balances. The assumption that breaks: that these adjustments stay consistent. When a path clamps a computed amount to an available balance, or treats a partial fill as a full close, one side of the ledger moves and the other does not. The result is leftover debt, leftover collateral, or a written-off position that still exists.

## Where it shows up
- A computed seize amount clamped to the user's balance without clamping the paired debt reduction [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-03.md).
- A payout capped to remaining collateral instead of reverting, while the caller still pays full consideration [E3](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-02.md).
- Leftover shares subtracted from pair totals but not from the borrower's per-user shares [E1](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-01.md).
- A liquidation that deletes margin on a condition like `positions.length == 1` while the closing order is IOC and may partially fill [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-15.md).
- Any `if (x > available) x = available;` in a liquidation path.

## How to review
For every liquidation path, trace both sides together: the debt removed and the collateral seized must be adjusted by the same event, and pair-level totals must equal the sum of per-user balances afterward. Check the invariant: after liquidation, a fully-liquidated borrower has zero shares and zero debt; a partially-liquidated one has both reduced proportionally. When an amount is clamped, confirm the paired amount is clamped identically or the call reverts [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-03.md)[E3](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-02.md). When a position is written off, confirm the close is guaranteed full (FOK) or that remaining amount is checked to be zero [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-15.md). When pair totals are reduced, confirm the borrower's shares are zeroed too [E1](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-01.md).

## Variants seen
- Asymmetric clamping: seize clamped, debt not [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-03.md).
- Silent truncation: payout capped without revert, liquidator underpays [E3](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-02.md).
- Leftover bad-debt shares persisting, enabling repeated no-op liquidations [E1](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-01.md).
- Partial-fill treated as full close, margin written off with residual position [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-15.md).

## Impact and severity
Protocol funds leak when debt removed exceeds collateral value [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-03.md); liquidators are underpaid or unpaid, deterring liquidation [E3](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-02.md); lending pairs lock up from repeated zero-share liquidations [E1](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-01.md); residual positions become protocol losses [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-15.md). Severity rises when the inconsistency is repeatable and when it blocks the liquidation mechanism itself.

## Why fixes fail
Clamping the visible amount without reconciling the paired debt or per-user balance leaves the invariant broken; the fix must adjust both sides or revert.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AH-01.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-02.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-15.md