# Liquidation guard edge-case accounting skips

Equality, last-item or timestamp guards in liquidation that skip bad-debt, lien or position accounting

_Area: DeFi oracles, liquidations and flash loans. Seen in 7 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
Liquidation code has branches that decide when debt is written off, when a position is closed, or when a counter is updated. Each branch is gated on a condition meant to capture "nothing left to account for": an exact equality, a "last collateral" flag, a timestamp, or a balance-vs-accounting comparison. When that guard under-specifies the real condition, a benign pre-state falls into the wrong branch: the write-off, decrement, or drain is skipped, or it fires while work remains. Equality and last-item checks rarely capture "nothing left" exactly.

## Where it shows up
- Guards using `==` between a computed seizure/amount and a stored balance, where the equality case is unhandled [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-16.md).
- "Last collateral" or "last auction" flags that zero remaining debt without checking for other in-flight auctions [E2](https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AH-01.md).
- Safety invariants replaced by an equality a pending-close account already satisfies [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-4.md).
- Loop exit conditions comparing a live token balance to a principal-only accounting value [E4](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.2.md).
- Default/liquidation predicates keyed on elapsed time or last-action timestamps instead of the repayment due date [E5](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-5.md)[E7](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-14.md).
- Time-window guards where sibling side effects (lien decrement, accountant setup) are gated but the auction is not [E6](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-25.md).

## How to review
For each liquidation branch, name the invariant it must preserve: debt written off only when no collateral remains sellable; position strictly decreases; every lien decremented exactly once; bad debt recorded whenever remaining debt > 0. Check boundary cases explicitly: equality, zero, last item, and the alternate time branch. Confirm the guard is a strict inequality or an explicit "no other work pending" check, not an equality a normal pre-state matches. For multi-collateral designs, verify the write-off also confirms no other auction is in flight [E2](https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AH-01.md). Verify accounting values include accrued yield, not just principal [E4](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.2.md). Compare default predicates against the repayment schedule function, not elapsed time [E5](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-5.md)[E7](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-14.md).

## Variants seen
- Equality boundary skips bad-debt cleanup [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-16.md).
- Last-collateral write-off ignores concurrent auctions [E2](https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AH-01.md).
- Removed position-decrease check replaced by trivially-satisfied equality, allowing position inflation [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-4.md).
- Principal-only accounting causes early loop exit, stranding yield [E4](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.2.md).
- Default window anchored to last-action timestamp or elapsed time, not due date [E5](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-5.md)[E7](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-14.md).
- Time-window guard skips lien decrement and accountant setup while auction proceeds [E6](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-25.md).

## Impact and severity
High: fund theft via position inflation [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-4.md), borrower capturing auction proceeds meant for debt [E2](https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AH-01.md), untracked bad debt [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-16.md), stranded admin funds [E4](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.2.md), premature collateral seizure [E5](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-5.md)[E7](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-14.md), and bypassed accountants halting an epoch [E6](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-25.md). Severity rises when the skipped accounting lets an attacker profit directly rather than merely mis-record state.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-4.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AH-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-16.md
- E4: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.2.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-5.md
- E6: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-25.md
- E7: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-14.md