# Blocked or missing liquidation path

Can every undercollateralized position actually be liquidated, or is the path blocked, gated, or self-defeating?

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
Liquidation is the safety valve that keeps a lending system solvent. The assumption is that any position that becomes undercollateralized can be closed by a third party. This pattern is where that assumption breaks: the liquidation path is absent, rejects the position, or is blocked by state the borrower or a counterparty controls. Debt keeps accruing while nothing can clear it, so bad debt accumulates.

## Where it shows up
- Borrow/position-creation paths that never enforce an invariant the liquidation path assumes (e.g. collateral asset must differ from debt asset) [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-17.md)
- Liquidation code that rejects a pair or position type that borrow still allows [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-17.md)
- Repayment or liquidation that validates a caller-supplied struct against mutable on-chain state another function rewrites [E3](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-10.md)
- Shutdown/emergency modes that leave redemption or liquidation entrypoints public and caller-selective [E1](https://bugbountylibrary.com/r/dhl%3A20250705-activepoolscrvusdurgentredemption.md)
- Settlement steps where collateral-to-seize exceeds debt-to-cover, causing the close to revert [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-17.md)

## How to review
The invariant: for every position the system can create, there exists at least one permissionless call sequence that fully closes it once it is undercollateralized, and no other actor can make that sequence revert. Check that borrow and liquidation enforce the same preconditions; that any hash or struct validated at repay time is not rewritten by a permissionless or counterparty-callable function; and that emergency/shutdown paths do not leave selective redemption open to arbitrage [E1](https://bugbountylibrary.com/r/dhl%3A20250705-activepoolscrvusdurgentredemption.md). Trace prepare/execute/settle end to end, not just the entry check [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-17.md).

## Variants seen
- Same-asset borrow allowed but liquidation rejects the pair; prepared path fails at settlement [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-17.md)
- Front-run state rewrite makes repayment revert, forcing liquidation of borrower collateral [E3](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-10.md)
- Post-shutdown public redemption lets callers cherry-pick undercollateralized troves for bonus collateral [E1](https://bugbountylibrary.com/r/dhl%3A20250705-activepoolscrvusdurgentredemption.md)

## Impact and severity
Outcomes ranged from stuck insolvent positions and forced liquidations [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-17.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-10.md) to direct collateral drain via flash-loan-funded redemption (~$4.2k) [E1](https://bugbountylibrary.com/r/dhl%3A20250705-activepoolscrvusdurgentredemption.md). Severity rises when the block is permissionless-triggerable and repeatable, and when flash loans make the capital cost near zero.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20250705-activepoolscrvusdurgentredemption.md
- E2: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-17.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-10.md