# Health check skipped on position change

Borrow, deposit or position-change paths that skip or mis-feed the health-factor check

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2025-10-20. Updated 2026-11-06._

## How it works
A lending or margin system must re-check solvency (health factor / LTV) after every action that changes a position: borrow, withdraw, open/close a leveraged position. The broken assumption is that each action is validated against the *current* position. When a path skips the check, or computes it from stale or share-based values, the account can end up under-collateralised while the code believes it is safe. The attacker then borrows or withdraws more than the true collateral supports.

## Where it shows up
- Separate entry points for opening a position and withdrawing collateral, with no shared post-action solvency check [E2](https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance.md).
- Lend and borrow of the same asset pair in one transaction, where LTV is not recomputed between the two steps [E1](https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md).
- Aave-fork `borrow` loops over reserves that trust a dust deposit as sufficient collateral [E3](https://bugbountylibrary.com/r/dhl%3A20241119-polterfinance-exploit.md).
- Health factor derived from share balances or cached values rather than freshly valued collateral.
- Deposit/borrow paths where the collateral asset's price or decimals are not validated before the check.

## How to review
For every function that changes collateral, debt or position size, confirm a solvency check runs *after* the state change and uses freshly valued collateral and debt. The invariant: after any single call or sequence of calls, `collateral_value * LTV >= debt_value` must hold, and no path may leave the account below it. Check that lend-then-borrow in one tx recomputes the factor between steps [E1](https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md), that withdraw and position-open each re-validate [E2](https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance.md), and that a minimal deposit cannot pass the check to unlock full-reserve borrows [E3](https://bugbountylibrary.com/r/dhl%3A20241119-polterfinance-exploit.md).

## How finders spotted it
- Noted that a lending pool allowed lending and borrowing the same asset pair in one transaction, then asked whether the health factor is recomputed between the two [E1](https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md).
- Observed that a margin router let a user open a leveraged position and separately withdraw supplied collateral, then checked whether solvency is re-validated after each action [E2](https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance.md).
- Saw in a PoC that a 1 wei / 1e18 SpookyToken deposit was accepted as enough collateral to borrow the entire aToken liquidity of every reserve [E3](https://bugbountylibrary.com/r/dhl%3A20241119-polterfinance-exploit.md).

## Variants seen
- Same-transaction lend/borrow with stale share-based LTV [E1](https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md).
- Position open plus collateral withdrawal without a post-insolvency check [E2](https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance.md).
- Dust deposit passing the health check and unlocking borrows across all reserves [E3](https://bugbountylibrary.com/r/dhl%3A20241119-polterfinance-exploit.md).

## Impact and severity
Critical: full or large pool drains. E1 drained 60 stETH [E1](https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md); E2 drained TradeRouter funds [E2](https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance.md); E3 drained ~$7M across all reserves [E3](https://bugbountylibrary.com/r/dhl%3A20241119-polterfinance-exploit.md). Impact rose when combined with flash loans to fund capital and manipulate price [E1](https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md)[E2](https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance.md), and when one deposit unlocked every reserve at once [E3](https://bugbountylibrary.com/r/dhl%3A20241119-polterfinance-exploit.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20250112-unilend.md
- E2: https://bugbountylibrary.com/r/dhl%3A20251020-sharwafinance.md
- E3: https://bugbountylibrary.com/r/dhl%3A20241119-polterfinance-exploit.md