# Liquidation blocked by reverting path

Can an underwater account's liquidation call be made to revert by state a non-privileged actor controls?

_Area: DeFi oracles, liquidations and flash loans. Seen in 53 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
Liquidation is the safety valve that keeps a lending or perp protocol solvent, and it only works if the liquidation call can complete. This pattern is where a revert inside the liquidation path — a stale read, a zero-value guard, a hardcoded floor, a drained reserve, an oracle sentinel, or a shared gate — makes the whole call fail. The assumption that breaks is that liquidation is always executable once an account is underwater. In practice the path depends on state the account owner, a borrower, or any permissionless actor can move, so the valve jams while the position keeps losing value.

## Where it shows up
- Liquidation orders subject to the same invariant checks as normal orders, which pending orders can already violate [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AM-3.md).
- Collateral seizure needs reserve liquidity that borrowers can drain [E2](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-3.md).
- Cached derived values (interest, share price) assumed monotonic, but liquidation decreases them [E3](https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AH-01.md).
- Wrapper values a position by tokensOwed, but unwrap passes liquidity=0 to a guard requiring >0 [E4](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.3.md).
- Off-chain signed price embeds a mutable on-chain nonce the borrower can bump [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-7.md).
- Hardcoded dust/leftover floor overlaps the close-factor-permitted repayment range [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-18.md).
- Safety cap exceeds a downstream math bound, so mid-range values revert [E7](https://bugbountylibrary.com/r/c4%3A2026-02-jupiter-lend%3AM-01.md).
- One oracle-deviation gate shared by liquidation, exercise and settlement paths [E8](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-06.md).

## How to review
Enumerate every revert site reachable from the liquidation entrypoint (static analysis plus manual trace). For each, ask: can the account owner, a borrower, or any permissionless actor cause that condition? The invariant: once an account is eligible, no state change available to a non-privileged party can make the liquidation call revert. Triage first: is the revert reachable only after eligibility, or can it also block the transition into eligibility? Then test same-block sequences (self-liquidation, repay, then liquidate) [E3](https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AH-01.md); verify liquidation orders bypass pending-order invariants [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AM-3.md); confirm collateral seizure is independent of borrowable liquidity [E2](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-3.md); check zero-value and max-value guards on downstream calls [E4](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.3.md); check whether signed inputs embed mutable on-chain state [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-7.md); model post-liquidation state algebraically against dust floors and caps [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-18.md)[E7](https://bugbountylibrary.com/r/c4%3A2026-02-jupiter-lend%3AM-01.md); and check whether one gate blocks several time-sensitive operations [E8](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-06.md).

## Variants seen
- Pending close exceeds position size, violating an invariant liquidation orders cannot satisfy [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AM-3.md).
- Collateral reserve drained so seizure reverts [E2](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-3.md).
- Monotonicity assumption broken by liquidation itself [E3](https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AH-01.md).
- Zero-liquidity unwrap guard [E4](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.3.md).
- Nonce bump invalidates signed price [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-7.md).
- Dust floor conflicts with close-factor cap [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-18.md).
- Cap exceeds downstream math bound [E7](https://bugbountylibrary.com/r/c4%3A2026-02-jupiter-lend%3AM-01.md).
- Shared oracle-deviation gate blocks liquidation [E8](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-06.md).

## Impact and severity
Liquidation is delayed or blocked, so underwater positions persist and bad debt accrues. Severity is high because the block is cheap and repeatable where an attacker controls the trigger [E2](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-3.md)[E8](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-06.md); self-inflicted or accidental blocks (pending-order mismatch, dust floor) are usually temporary and recoverable [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AM-3.md)[E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-18.md). Distinguish temporary blocks from indefinite ones (drained reserve, permanent cap mismatch), and note when liquidator capital is trapped, which removes the incentive to liquidate at all [E4](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.3.md)[E7](https://bugbountylibrary.com/r/c4%3A2026-02-jupiter-lend%3AM-01.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AM-3.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-3.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AH-01.md
- E4: https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.3.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-7.md
- E6: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-18.md
- E7: https://bugbountylibrary.com/r/c4%3A2026-02-jupiter-lend%3AM-01.md
- E8: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-06.md