# Liquidation bypasses token transfer constraints

Liquidation or burn paths that update accounting without honoring pause, freeze, or transfer checks

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2024-10-22. Updated 2026-10-24._

## How it works
Two code paths reach the same economic outcome, but only one performs real token transfers. The liquidation or settlement path updates internal accounting (increment/applyDelta, burn, payout math) and never moves the underlying token, so token-level constraints — pause, freeze, blacklist, invalid-asset status — never fire. Users who must transfer tokens to defend their position are blocked, while the keeper path proceeds. The broken assumption: that all paths to liquidation are subject to the same token restrictions.

## Where it shows up
- Liquidation functions that only call accounting helpers and never `transfer`/`transferFrom` collateral.
- Asymmetry between decrease/close/add-collateral orders (real transfers) and liquidation (accounting only).
- Token `flashLoan`/burn logic that does not check freeze status before burning.
- Governance branches that special-case an invalidated asset with different payout math.
- Pause, freeze, or blacklist flags on collateral tokens that gate some flows but not others.

## How to review
For every path that changes a position's economic state, list the external token operations it performs. The invariant: any path that can liquidate, seize, or burn must be subject to the same token-level constraints (pause, freeze, blacklist, validity) as the paths users rely on to defend or exit. If liquidation is accounting-only, confirm it cannot proceed when the collateral token is non-transferable. For invalid-asset branches, verify payout math applies the same vault/pool factor split as the valid branch.

## Variants seen
- Accounting-only liquidation proceeds while collateral token is paused, blocking user defense [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-11.md).
- Invalid-collateral branch shifts liability to the pool, making inaction profitable for the vault owner [E2](https://bugbountylibrary.com/r/c4%3A2025-08-flare-fasset%3AM-01.md).
- Flash loan burns tokens without freeze check, leaving burned tokens usable [E3](https://bugbountylibrary.com/r/dhl%3A20241022-vista.md).

## Impact and severity
Users can be liquidated while unable to close or add collateral [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-11.md); vault owners dodge ~50% of liability [E2](https://bugbountylibrary.com/r/c4%3A2025-08-flare-fasset%3AM-01.md); burned tokens remain spendable for profit [E3](https://bugbountylibrary.com/r/dhl%3A20241022-vista.md). Severity rises when the constraint is governance-triggered and predictable, and when keepers are permissionless.

## Why fixes fail
Evidence does not show regressed fixes.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-11.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-08-flare-fasset%3AM-01.md
- E3: https://bugbountylibrary.com/r/dhl%3A20241022-vista.md