# Liquidation boundary and inequality inversion

Inverted, strict, or equality-triggered comparisons in health, liquidation, and oracle-gated state checks

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2023-01-31. Updated 2026-11-01._

## How it works
A threshold check encodes a policy: who is liquidatable, when a depeg fires, whether collateral is the last one. The bug is that the comparison operator or the value it compares does not match that policy. Three shapes: the operator points the wrong way, so healthy accounts read as liquidatable and vice versa [E3](https://bugbountylibrary.com/r/c4%3A2021-04-marginswap%3AH-05.md); a strict `<` where the spec says "below" lets the equality case through, firing a state transition one tick early [E2](https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AH-09.md); or the predicate is computed from a derived value (cached oracle price times count) rather than the real quantity, so a zero oracle return collapses the check [E1](https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AM-07.md). In each case the code runs, tests may pass, and the wrong branch is taken at the boundary.

## Where it shows up
- Health/liquidation predicates: `holdings >= threshold * loan` style comparisons, especially with a comment stating the intended invariant [E3](https://bugbountylibrary.com/r/c4%3A2021-04-marginswap%3AH-05.md)
- Oracle-gated modifiers (`isDisaster`, depeg, settlement) using `<` or `>` where docs say "below"/"above" [E2](https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AH-09.md)
- "Last collateral" or "fully liquidated" flags inferred from a value that includes an oracle price or a count [E1](https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AM-07.md)
- Any branch that treats a zero/empty oracle return as a meaningful state
- Boundary equality: price == strike, collateral == threshold, debt == remaining

## How to review
State the intended invariant in words, then translate it by hand into an inequality and compare direction and strictness to the code. The property that must hold: for every input, the predicate returns true exactly when the policy says the condition is met, including the equality case. Check each comparison against its spec or comment [E3](https://bugbountylibrary.com/r/c4%3A2021-04-marginswap%3AH-05.md)[E2](https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AH-09.md). For derived state flags, ask what the flag is computed from and whether that source can be zero or stale; a flag must derive from the actual quantity (NFT count), not an oracle-scaled value [E1](https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AM-07.md). Test the boundary inputs explicitly: equal prices, zero oracle returns, exactly-at-threshold collateral.

## How finders spotted it
- Read the comment stating the invariant (`holdings / loan >= 1.1`), translated the implemented inequality by hand, and saw it was inverted [E3](https://bugbountylibrary.com/r/c4%3A2021-04-marginswap%3AH-05.md)
- Read docs saying depeg requires price strictly below strike, then compared to the `isDisaster` modifier and noticed `<` admits equality [E2](https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AH-09.md)
- Noticed `isLastCollateral` derived from a cached oracle value rather than count, then verified the oracle can return zero [E1](https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AM-07.md)

## Impact and severity
High. Inverted logic lets healthy accounts be liquidated and undercollateralized ones escape [E3](https://bugbountylibrary.com/r/c4%3A2021-04-marginswap%3AH-05.md); equality-triggered depeg lets anyone fire the event at the wrong price [E2](https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AH-09.md); a zero oracle price zeroes remaining debt so the owner withdraws other NFTs free [E1](https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AM-07.md). Severity rises when the boundary is permissionlessly reachable or the oracle can return zero.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AM-07.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AH-09.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-04-marginswap%3AH-05.md