# Liquidation accounting reverts block bad debt

Liquidation math that reverts, underflows, or rounds to zero, leaving bad debt or collateral mishandled

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2024-07-16. Updated 2026-10-23._

## How it works
Liquidation code assumes a fixed relationship between who pays, who receives, and how shares/amounts compare. When that assumption breaks — the caller is a callback contract rather than the liquidator, an account's share balance grows independently of its withdraw request, or a user-supplied divisor drives repayment to zero — the accounting either reverts (blocking liquidation entirely) or pays out collateral for nothing. The invariant that must hold: every liquidation path moves exactly the debt owed from the liquidator and exactly the corresponding collateral to them, with no branch that reverts on valid bad-debt states.

## Where it shows up
- Internal `safeTransferFrom(msg.sender, ...)` in liquidation branches where `msg.sender` is a Market/callback contract, not the end user.
- Subtraction-based share splits (`w.vaultShares - vaultShares`) where an account's balance can exceed its recorded request.
- User-supplied divisors or scaling factors applied to both repayment and payout without a cap.
- Integer division of liabilities that can round to zero while collateral payout stays nonzero.
- Bad-debt branches with no test coverage.

## How to review
Trace each liquidation transfer point and confirm who `msg.sender` actually is and whether that address holds allowance and balance. For share splits, check whether balances can grow via receiving shares from others' liquidations, and whether the subtraction can underflow. For scaling math, test extreme divisor values: confirm repayment and payout round in the same direction and that zero repayment implies zero payout. The property: liquidation of a negative-margin or small position must succeed and settle debt and collateral consistently.

## Variants seen
- Bad-debt repayment pulled from the Market contract instead of the liquidator, so negative-margin vaults can never be liquidated [E1](https://bugbountylibrary.com/r/c4%3A2024-05-predy%3AH-04.md).
- Liquidator's vaultShares exceed withdrawRequest after acquiring shares, underflowing the split and blocking their own liquidation [E2](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AM-2.md).
- Uncapped strain divisor zeroes repayment while collateral payout remains, letting a liquidator seize collateral for gas [E3](https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AM-10.md).

## Impact and severity
Bad debt accumulates unliquidated [E1](https://bugbountylibrary.com/r/c4%3A2024-05-predy%3AH-04.md), liquidators become unliquidatable themselves [E2](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AM-2.md), and collateral is stolen without repaying debt [E3](https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AM-10.md). Severity is high where liquidation is fully blocked or funds are taken; worse when no tests cover the branch and the assumption is silent.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-05-predy%3AH-04.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AM-2.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AM-10.md