# Wrong health metric in liquidation checks

Liquidation or health checks comparing the wrong ratio, variable, or sign instead of the price-adjusted metric

_Area: DeFi oracles, liquidations and flash loans. Seen in 6 disclosed reports; latest 2025-02-17. Updated 2026-10-23._

## How it works
A liquidation or health check is only as correct as the quantity it compares. The root cause is that the check evaluates a proxy for solvency rather than the actual price-adjusted, sign-correct metric the protocol's invariant requires. Common breaks: using a weighted or nominal ratio where a raw price-based one is needed, comparing the wrong variable (threshold vs current LTV), or letting sign conventions make an inequality trivially true. The result is a dead zone: positions that violate the intended invariant but that the check classifies as healthy (or vice versa), so liquidation either reverts or fires wrongly.

## Where it shows up
- Liquidation guards that use total CR including soft/illiquid collateral, while mint/withdraw enforce a stricter exogenous-only invariant [E1](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-07.md)
- Bad-debt or health checks reusing risk-weighted collateral/debt values instead of raw excess [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AM-8.md)
- Post-liquidation debt checks subtracting a positive deposit from a negative debt, making the comparison always pass [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AH-7.md)
- Health-factor getters that take no price (nominal ICR) instead of the price-dependent current ICR [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-17.md)
- Branch conditions gating on `threshold` when the spec means current `ltv` [E5](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-09.md)

## How to review
Identify the exact invariant (e.g. exogenous value covers minted debt; post-liquidation debt >= min borrow; LTV > absorption threshold). Then confirm the check computes that same quantity with the same inputs and sign as the enforcement path. Diff the guard used in liquidate against the guards in mint/withdraw/borrow: they must be consistent [E1](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-07.md). Verify the getter is price-dependent where the protocol's ICR is [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-17.md). Check inequality direction and sign of each operand [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AH-7.md). Confirm the variable named in the spec is the one compared [E5](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-09.md).

## Variants seen
- Stricter invariant on mint/withdraw than on liquidate, leaving unliquidatable positions [E1](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-07.md)
- Weighted ratio misclassifies a liquidatable pool as bad debt [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AM-8.md)
- Sign error makes a minimum-debt check always true [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AH-7.md)
- Nominal (no-price) health getter always below threshold [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-17.md)
- Wrong variable (threshold vs LTV) creates an absorption gap [E5](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-09.md)

## Impact and severity
Outcomes ranged from unliquidatable under-collateralized positions breaking 1:1 backing [E1](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-07.md), blocked liquidators causing LP/MM losses [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AM-8.md), bad debt left below min borrow [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AH-7.md), bricked borrow/repay [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-17.md), to temporarily blocked absorption [E5](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-09.md). Severity rises when the dead zone is reachable by ordinary market movement or oracle manipulation and when no alternate path can correct the position.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-07.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AM-8.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AH-7.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-17.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-09.md