# Partial liquidation breaks full-size close assumptions

Close and liquidation paths assuming full position size or skipping maintenance checks after partial liquidation

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2025-02-17. Updated 2026-10-30._

## How it works
A close or liquidation path assumes the position is still the size it was at open, or that a close cannot itself make the account unhealthy. When the underlying protocol has already reduced the position (e.g. a partial liquidation), or when fees charged during close push the account below maintenance, the invariant the code relies on no longer holds. The result is a revert that traps funds, or a self-liquidation that leaves a zero-collateral position whose losses fall on the protocol.

## Where it shows up
- Close logic that un-loops using the full amount recorded at open, ignoring partial liquidation [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AM-19.md)
- Close paths that charge fees but never re-check the maintenance invariant [E1](https://bugbountylibrary.com/r/sherlock%3A2023-05-perennial%3AM-11.md)
- Liquidation incentive not scaled to remaining size (fixed minimum) [E1](https://bugbountylibrary.com/r/sherlock%3A2023-05-perennial%3AM-11.md)
- Solvency checks that require solvency at both market price and execution price, rejecting a favorable close [E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-symmetrical%3AM-1.md)
- Wrapper contracts caching collateral/debt balances the underlying can change mid-life (liquidation, interest) [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AM-19.md)

## How to review
For every close, partial-close and liquidation path, check the exact invariant: after the operation, the account state must reflect the actual remaining size, and any solvency/maintenance check must be evaluated on the post-operation balances. Confirm the code reads live balances from the underlying rather than cached open-time amounts [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AM-19.md). Confirm fees charged during close are included in the post-close health check [E1](https://bugbountylibrary.com/r/sherlock%3A2023-05-perennial%3AM-11.md). Confirm liquidation incentives scale with remaining size, not a fixed minimum [E1](https://bugbountylibrary.com/r/sherlock%3A2023-05-perennial%3AM-11.md). For close-price flows, confirm solvency is evaluated at the execution price, not both market and execution price [E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-symmetrical%3AM-1.md).

## Variants seen
- Self-liquidation to zero collateral via fee-induced unhealthiness and fixed minimum incentive [E1](https://bugbountylibrary.com/r/sherlock%3A2023-05-perennial%3AM-11.md)
- Solvency evaluated at wrong price blocks a solvent close, enabling unfair liquidation [E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-symmetrical%3AM-1.md)
- Full-size un-looping reverts after external partial liquidation, trapping cTokens and debt [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AM-19.md)

## Why fixes fail
In one instance, a prior fix addressed only the request-to-close path; the sibling fillCloseRequest path kept the same flawed solvency logic [E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-symmetrical%3AM-1.md). This is a single observed case, not a general rule, but it shows fixes must cover every path that shares the invariant.

## Impact and severity
Trapped user funds [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AM-19.md), unfair liquidation of solvent users [E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-symmetrical%3AM-1.md), and protocol shortfall from zero-collateral positions [E1](https://bugbountylibrary.com/r/sherlock%3A2023-05-perennial%3AM-11.md). Severity rises when the flawed path is reachable permissionlessly or by the position owner, and when no maintenance check guards the close.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-05-perennial%3AM-11.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-08-symmetrical%3AM-1.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AM-19.md