# Liquidation reverts on tiny repay

Liquidation math where a small or zero repay shrinks the cap or trips a strict inequality and reverts

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2024-05-03. Updated 2026-10-25._

## How it works
Liquidation math often compares a caller-supplied amount against a cap derived from live state, or against a timestamp boundary. When that cap is recomputed from current balances (or a timestamp is resettable to exactly the cutoff), the borrower can move the cap by the smallest possible unit before the liquidation lands. If the check reverts on excess instead of clamping, the whole liquidation transaction fails, so the liquidator's fixed amount becomes invalid and the position stays unliquidated. The broken assumption is that the cap is stable between the liquidator's quote and execution; it is not, because the borrower controls the inputs.

## Where it shows up
- A validation that reverts (e.g. `TooManyShares`) when a caller amount exceeds a cap computed from live borrow shares [E1](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-08.md)
- Caps derived from `getPositionBorrowShares` or similar live reads rather than a snapshot [E1](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-08.md)
- Strict `>` comparisons between a mutable timestamp and a cutoff, where equality slips through [E2](https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-10.md)
- Functions callable with a zero or one-unit amount that still mutate the guarded state [E1](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-08.md)[E2](https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-10.md)
- Liquidation math that clamps a seize amount without clamping the paired debt reduction [E3](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-03.md)

## How to review
Identify every liquidation guard that compares a caller-supplied amount to a value the borrower can change. The invariant: a liquidation of a valid amount must not be invalidated by a repayment or state nudge smaller than that amount. Check whether the guard clamps to the cap instead of reverting, and whether the cap is snapshotted at quote time. For timestamp guards, verify the equality boundary is handled (use `>=` or reject zero-amount calls). For seize/debt pairs, confirm both sides are clamped together [E3](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-03.md).

## Variants seen
- Tiny repayment shrinks max liquidable shares below the liquidator's amount, reverting the tx [E1](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-08.md)
- Zero-amount `addPremium` resets `startTime` to the cutoff, blocking forced liquidation [E2](https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-10.md)
- Seize amount clamped to collateral while debt removed stays inflated, leaking funds [E3](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-03.md)

## Impact and severity
Liquidations can be blocked indefinitely, leaving bad debt to accrue [E1](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-08.md)[E2](https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-10.md), or the protocol can leak funds when debt removed exceeds collateral value [E3](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-03.md). Severity rises when the nudge is free (zero or one unit) and repeatable, and when no alternative liquidation path exists.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-08.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-10.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-03.md