# Liquidation repay cap and collateral mismatch

Liquidation repays more than collateral covers, or one slippage bound shared across batch positions

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2025-07-02. Updated 2026-11-06._

## How it works
Liquidation code assumes two things that are not always true: that the amount repaid is covered by the collateral seized, and that one slippage/limit parameter fits every position in a batch. When either assumption breaks, the caller (or the liquidator) pays more than the position is worth, or a shared bound under-protects some positions and reverts others. The root cause is a missing per-position invariant: repaid debt must be bounded by available collateral plus fee, and each swap limit must be derived from that position's own expected output.

## Where it shows up
- Liquidation functions that repay a caller-supplied share/amount without checking it against available collateral [E3](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AM-05.md).
- Batch liquidation loops that decode one `minAssetAmount` (or similar) from shared `dexData` and apply it to every borrower [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-20.md).
- Emergency/shutdown redemption paths that become permissionless and let the caller choose which troves to redeem against [E2](https://bugbountylibrary.com/r/dhl%3A20250702-activepoolurgentredemption.md).
- Redemption bonuses that can exceed the cost paid, making cherry-picking profitable [E2](https://bugbountylibrary.com/r/dhl%3A20250702-activepoolurgentredemption.md).

## How to review
- For every liquidation entry point, confirm the repaid amount is capped by collateral available plus fee; trace where the cap is enforced, not just where it is documented [E3](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AM-05.md).
- In batch paths, confirm slippage/limit parameters are per-item, derived from each position's expected output, not decoded once [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-20.md).
- For shutdown/emergency redemption, confirm the caller cannot select which positions to redeem against, or that selection cannot yield a bonus above cost [E2](https://bugbountylibrary.com/r/dhl%3A20250702-activepoolurgentredemption.md).
- Check whether ordering (MEV, validator insertion) can front-run a well-calculated liquidation and cause leakage even with a deadline [E3](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AM-05.md).

## How finders spotted it
- Read `_liquidateUser` and noticed `minAssetAmount` decoded once from `dexData` and reused across the multi-borrower loop, inconsistent with per-position slippage needs [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-20.md).
- Recognized that post-shutdown `urgentRedemption` was permissionless and let the caller choose `troveIds`, enabling cherry-picking of troves whose bonus made redemption profitable [E2](https://bugbountylibrary.com/r/dhl%3A20250702-activepoolurgentredemption.md).
- Code review of `liquidateClean` found no check that repaid shares were covered by available collateral; confirmed with an e2e test dropping price [E3](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AM-05.md).

## Variants seen
- Shared batch slippage bound across heterogeneous positions [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-20.md).
- Permissionless emergency redemption with caller-chosen troves and a bonus [E2](https://bugbountylibrary.com/r/dhl%3A20250702-activepoolurgentredemption.md).
- Unbounded repay amount in a single liquidation [E3](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AM-05.md).

## Why fixes fail
- A deadline or `_totalBorrow` bound does not stop MEV-ordering leakage; the judge noted validator/MEV ordering can still insert repayment ahead of a calculated liquidation [E3](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AM-05.md).

## Impact and severity
- Under-protected swaps or whole-batch reverts [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-20.md).
- Drain of sUSDe collateral from ActivePool after shutdown [E2](https://bugbountylibrary.com/r/dhl%3A20250702-activepoolurgentredemption.md).
- Liquidator overpays assets for far less collateral; leakage amplified by MEV ordering [E3](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AM-05.md). Severity rises when the path is permissionless and the caller can pick positions [E2](https://bugbountylibrary.com/r/dhl%3A20250702-activepoolurgentredemption.md), and when ordering can be manipulated [E3](https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AM-05.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-20.md
- E2: https://bugbountylibrary.com/r/dhl%3A20250702-activepoolurgentredemption.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AM-05.md