# Unbounded liquidation price computation

Liquidation/auction price from debt or decay with no market floor or cap

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2026-03-07. Updated 2026-10-24._

## How it works
Liquidation must price collateral so a liquidator is paid for taking risk, but that price must stay anchored to real market value. The weakness is a liquidation or auction price computed from an internal quantity (debt, collateral count, elapsed time) with no floor, cap, or market reference. The broken assumption is that the formula's output tracks what the collateral is actually worth. When debt rises, collateral count falls, or an auction decays, the computed price drifts from market: too high and liquidators overpay and skip, too low and takers buy collateral for less than lenders are owed.

## Where it shows up
- Auction price as a pure time-decay function with no lower bound tied to the loan's bucket/fenwick index [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-16.md).
- Per-token liquidation price computed as debt divided by collateral count, with no oracle cap [E3](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-13.md).
- Oracle adapters that branch on transient controller state (e.g. `isControlCollateralInProgress()`) and return a different price inside the liquidation transfer than in the pre-transfer balance check [E1](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.6.md).

## How to review
Identify every price used in liquidation and auction paths and ask what bounds it. The invariant: the liquidation price must be bounded by a market reference (oracle price, pool index, or explicit floor/cap) at all times, and the same price must be used in the pre-liquidation balance check and inside the collateral transfer. For decaying auctions, confirm the curve has a floor tied to the lenders' basis [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-16.md). For debt-derived prices, confirm an upper bound exists so a crash does not push implied price above market [E3](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-13.md). For oracle adapters, confirm no branch on transient controller state changes the returned price across the liquidation flow [E1](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.6.md).

## Variants seen
- Time-decaying auction price with no floor, decaying below pool floor price [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-16.md).
- Debt/collateral-count derived NFT price with no cap, inflated by interest accrual or price crash [E3](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-13.md).
- Oracle adapter returning mid-point price during controlCollateral transfer, leaving dust that blocks bad-debt socialization [E1](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.6.md).

## Impact and severity
Pool insolvency when takers bought collateral below lenders' basis [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-16.md); skipped liquidations and bad debt when liquidators had to overpay [E3](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-13.md); dust collateral blocking bad-debt socialization [E1](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.6.md). Severity rises when the mispricing is systematic (every liquidation) rather than edge-case, and when it interacts with partial liquidation or interest accrual.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.6.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-16.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-13.md