# Caller-supplied liquidation data trusted

Liquidator picks swap path, market, oracle or repay amount the protocol then trusts

_Area: DeFi oracles, liquidations and flash loans. Seen in 18 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
Liquidation entrypoints accept values from the liquidator: a swap path/router, a reserve/market/oracle address, a repay amount, or an amount returned by an external swap. The code then treats these as if the protocol produced them. The broken assumption is that the caller is neutral and supplies honest data. Three shapes, each with its own fix: (1) caller-controlled venue — swap routing; (2) caller-controlled address — fake market/reserve; (3) caller-controlled amount — repay size. When the caller controls the venue, the price source, or the amount compared in a safety branch, they can divert residual collateral, fake a zero cost, or satisfy a "healthy" branch meant to protect the protocol.

## Where it shows up
- Liquidation functions forwarding caller `data`/`path` into an external swap or router [E1](https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AH-03.md).
- Reserve, vault, market, or oracle address taken as a parameter and used without registry validation [E2](https://bugbountylibrary.com/r/dhl%3A20240926-onyxdao.md)[E4](https://bugbountylibrary.com/r/dhl%3A20260324-xocolatlliquidator.md).
- A capped/sanitized amount computed for accounting but the raw caller input forwarded downstream [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-15.md).
- Safety branches comparing collateral against a caller-chosen repay amount [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-2.md).
- Permissionless emergency/shutdown paths where the caller picks which positions to redeem against [E7](https://bugbountylibrary.com/r/dhl%3A20250702-activepoolurgentredemption.md).
- Address built by ORing a caller-supplied mask into a trusted address [E8](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-06.md).

## How to review
For each liquidation entrypoint, list every caller-supplied value and trace it to its use. The invariant: no caller-supplied address, path, price, repay amount, or returned amount may determine how much collateral the liquidator receives, what cost is charged, or whether a safety branch passes, unless it is validated against a protocol registry and bounded by protocol-side values. For swap data, confirm the output is bounded by a protocol-side valuation, not just a repay minimum [E1](https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AH-03.md). Confirm the capped variable, not the raw input, reaches the router [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-15.md). Confirm the repay amount used in reward branches is protocol-bounded [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-2.md). For E2/E4: enumerate every registry membership check on the address parameter and confirm who can register entries — registry validation is useless if the registry itself is caller-influenced. For E7: the shared invariant is that the caller must not choose which positions are redeemed against when a bonus is paid.

## Variants seen
- Malicious swap data diverts residual collateral profit [E1](https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AH-03.md).
- Fake market address returns arbitrary values, draining funds [E2](https://bugbountylibrary.com/r/dhl%3A20240926-onyxdao.md).
- Small caller-chosen repay bypasses bad-debt reward reduction [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-2.md).
- Fake reserve address returns zero cost, draining vault collateral [E4](https://bugbountylibrary.com/r/dhl%3A20260324-xocolatlliquidator.md).
- Permissionless redemption lets caller cherry-pick underwater troves for a bonus [E7](https://bugbountylibrary.com/r/dhl%3A20250702-activepoolurgentredemption.md).
- Caller-supplied mask ORed into pool address redirects swap [E8](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-06.md).

## Impact and severity
Loss of borrower residual collateral, vault collateral drained (3.25 cbETH + 0.22 WETH [E4](https://bugbountylibrary.com/r/dhl%3A20260324-xocolatlliquidator.md); >$3.8M [E2](https://bugbountylibrary.com/r/dhl%3A20240926-onyxdao.md)), protocol bad debt, and excess bonus paid out. Severity is high where the liquidator both chooses the venue/price and receives the residual, since the protocol has no independent valuation.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AH-03.md
- E2: https://bugbountylibrary.com/r/dhl%3A20240926-onyxdao.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-2.md
- E4: https://bugbountylibrary.com/r/dhl%3A20260324-xocolatlliquidator.md
- E5: https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AM-04.md
- E6: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-15.md
- E7: https://bugbountylibrary.com/r/dhl%3A20250702-activepoolurgentredemption.md
- E8: https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-06.md