# Liquidation seizure scope and membership errors

Can one actor set both sides of a liquidation, or seize collateral outside the borrower's enabled set?

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2026-08-28. Updated 2026-10-30._

## How it works
Liquidation assumes the borrower and the liquidator are independent, and that the collateral being seized is the collateral counted in the health check. Three assumptions break: (1) in oracle-free designs, auction and bucket prices come only from pool internal state, so one actor controlling both borrower and taker sets the price both sides trade at [E1](https://bugbountylibrary.com/r/dhl%3A20260828-ajnafinance.md); (2) health checks that read live `balanceOf(position)` let anyone inflate a position's asset value by donating tokens, skewing the weighted-average LTV used to decide health [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-13.md); (3) seize paths that never confirm the asset is still enabled collateral let a liquidator take assets the borrower already removed from the liquidity calculation [E3](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-06.md).

## Where it shows up
- Oracle-free lending where auction/bucket prices derive purely from internal pool state [E1](https://bugbountylibrary.com/r/dhl%3A20260828-ajnafinance.md)
- Health or LTV math reading `IERC20.balanceOf(position)` instead of tracked deposits [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-13.md)
- Weighted-average LTV that weights debt by live per-asset balances [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-13.md)
- `preLiquidateHook`/`preSeizeHook` with no check that the collateral market is still a member of the borrower's enabled set [E3](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-06.md)
- Compound-derived comptrollers where `exitMarket` toggles collateral membership [E3](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-06.md)

## How to review
State the invariant and check it holds on every path:
- The actor choosing liquidation terms must not be the same actor who controls the borrower's position, or the internal price must be bounded by something external [E1](https://bugbountylibrary.com/r/dhl%3A20260828-ajnafinance.md).
- Health must be computed from tracked accounting, not live balances; a transfer into a position must not change its health [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-13.md).
- Every seize/heal path must verify the asset is still enabled collateral for that borrower before transfer [E3](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-06.md).
Trace `exitMarket` and donation paths into liquidation, not just the happy path.

## Variants seen
- Self-controlled liquidation in an oracle-free Dutch auction, manipulating bucket prices [E1](https://bugbountylibrary.com/r/dhl%3A20260828-ajnafinance.md)
- Donated low-LTV collateral skewing weighted-average LTV to force a healthy position liquidatable [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-13.md)
- Seizure from an exited market due to a missing membership check [E3](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-06.md)

## Impact and severity
E1 drained ~$124.8K from one pool (~48 cbETH for ~3.5 WETH). E2 and E3 enable unjust liquidation of healthy or exited positions. Severity rises when the attacker can shape both sides of the trade or when the seize path has no membership gate at all.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260828-ajnafinance.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-13.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-06.md