# Liquidation incentive and seizure math errors

Check liquidation math for wrong base, per-step incentive, and validated-then-mutated amounts

_Area: DeFi oracles, liquidations and flash loans. Seen in 5 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
Liquidation math must keep one invariant: the collateral seized and the debt repaid must be computed from the same base, at the same step, with the same bounds. The assumption that breaks is that the amount validated, the amount used, and the amount seized stay consistent. When an incentive is applied per partial step, when a clamp mutates an already-validated amount, or when a reward is subtracted before the solvency check, the numbers drift apart and a liquidator can take more collateral than the debt justifies, or trigger liquidation on a healthy position.

## Where it shows up
- Bad-debt or zero-collateral branches where debt can be repaid for no collateral [E1](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.13.md)
- A user-supplied amount validated, then silently bumped by a min-amount/dust clamp before use [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-06.md)
- Incentive applied on each partial liquidation, worsening collateral-to-debt ratio [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AM-6.md)
- A two-step deferred flow that zeroes a balance, then assumes it stays zero while another path credits it [E4](https://bugbountylibrary.com/r/sherlock%3A2024-06-symmetrical-update-2%3AM-1.md)
- Reward or fee subtracted from collateral/premium values before the underwater comparison [E5](https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-06.md)

## How to review
Trace every liquidation path and confirm: the value checked against the close factor is the value actually used; the seize amount and debt repaid derive from the same base; the incentive is applied once, not per partial step; and the solvency check uses undiscounted values. For deferred flows, enumerate every writer to the balance between steps. The invariant: debt repaid and collateral seized are symmetric, and no clamp or fee changes the amount after validation.

## Variants seen
- Frontrunner seizes all collateral in bad-debt branch, victim repays for nothing [E1](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.13.md)
- Close factor validated before min_remaining_debt bump to full debt [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-06.md)
- Per-partial incentive pushes position to bad debt or reverts on full liquidation [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AM-6.md)
- Fee credit after deferred zeroing inflates liquidator payout [E4](https://bugbountylibrary.com/r/sherlock%3A2024-06-symmetrical-update-2%3AM-1.md)
- Reward deducted before solvency check causes premature liquidation [E5](https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-06.md)

## Impact and severity
Loss of collateral to frontrunners, overpayment of liquidation fees, and wrongful liquidation of healthy positions. Severity rises where mempool ordering lets an attacker capture the asymmetry [E1](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.13.md) and where the error is silent, passing normal checks [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-06.md)[E5](https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-06.md).

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.13.md
- E2: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-06.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AM-6.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-06-symmetrical-update-2%3AM-1.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-06.md