# Liquidation skips post-action solvency check

Does every liquidation exit path recompute solvency after repay/seize/swap, including partial and self-directed closes?

_Area: DeFi oracles, liquidations and flash loans. Seen in 16 disclosed reports; one confirmed bounty: $116,513; latest 2026-08-20. Updated 2026-10-23._

## How it works
Liquidation is assumed to leave the account healthier or fully closed. That assumption breaks when repay/seize/swap/slash run but the code never recomputes the health factor or bad-debt state afterward, or only recomputes it on a terminal branch, or recomputes it on an incomplete state. The account can then end in a state the protocol never validated: debt unpaid, collateral drained, or a shortfall left unsocialized. The invariant that must hold is: after every liquidation path, the resulting account state is re-checked against the solvency rule, and any residual shortfall is either zero or explicitly socialized.

## Where it shows up
- `liquidate()` unwraps collateral via a swap honoring a user-supplied `minimumAmountOut`, then never calls `_validate()`; borrower-controlled, so the borrower can self-sandwich the unwrap [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-alchemix-missing-solvency-check-bugfix-review.md).
- Safety check nested inside `if (!hasPosition)`, so a near-full close skips the negative-margin compensation [E2](https://bugbountylibrary.com/r/c4%3A2024-05-predy%3AH-02.md).
- `liquidate()` calls a collateral-removal helper (`forceRemoveCollateral()`) that bypasses the solvency check, with no post-liquidation verification [E7](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.3.md).
- `internal_liquidation_call` checks only pre-liquidation health and close factor, never recomputing post-state HF [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-01.md).
- Health recomputed after `repay` but before `slash`, so the check runs on reduced debt with unslashed delegation and closes liquidation early [E8](https://bugbountylibrary.com/r/sherlock%3A2025-07-cap%3AM-1.md).
- Liquidation permits an account to end with negative collateral that is never reset to zero or socialized [E4](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AM-4.md).

## How to review
Walk each liquidation exit path in order: (1) entry — confirm pre-state health and close factor are checked; (2) after repay — confirm debt is reduced; (3) after seize/swap/slash — confirm all balance-changing steps complete before any health recomputation; (4) finalize — confirm a post-action solvency recomputation runs on every path, including partial closes and self-initiated flows. Check that user-controlled swap parameters cannot reduce proceeds below what repays debt before validation [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-alchemix-missing-solvency-check-bugfix-review.md). Test the boundary just short of full closure [E2](https://bugbountylibrary.com/r/c4%3A2024-05-predy%3AH-02.md). Confirm a shortfall is zeroed or socialized, not left as negative collateral [E4](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AM-4.md).

## Variants seen
- Missing post-swap validation with user-controlled minimum out, borrower self-sandwich [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-alchemix-missing-solvency-check-bugfix-review.md).
- Completion-gated check skipped by 99.99% close [E2](https://bugbountylibrary.com/r/c4%3A2024-05-predy%3AH-02.md).
- Collateral-removal helper bypassing solvency check [E7](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.3.md).
- Pre-state-only health check, no post-state recompute [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-01.md).
- Check ordered between repay and slash, running on incomplete state [E8](https://bugbountylibrary.com/r/sherlock%3A2025-07-cap%3AM-1.md).
- Unsocialized negative collateral left after bad-debt liquidation [E4](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AM-4.md).

## Impact and severity
Led to unbacked debt minted (~7k alETH) [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-alchemix-missing-solvency-check-bugfix-review.md), bad debt from repeated bonus seizure worsening solvency [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-01.md), liquidators seizing collateral plus bonus while leaving debt behind [E7](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.3.md), and a withdrawal race where early withdrawers drain funds and last users lose out [E4](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AM-4.md). Severity rises when the borrower controls the swap or can act between partial steps, and when shortfalls are never socialized.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-alchemix-missing-solvency-check-bugfix-review.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-05-predy%3AH-02.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-25.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AM-4.md
- E5: https://bugbountylibrary.com/r/dhl%3A20250705-activepoolscrvusdurgentredemption.md
- E6: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-01.md
- E7: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.3.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2025-07-cap%3AM-1.md