# Liquidation reward miscomputation

Liquidation bonus or reward computed on an owner- or caller-controlled base, uncapped, or paid on a deprecated path

_Area: DeFi oracles, liquidations and flash loans. Seen in 4 disclosed reports; latest 2024-12-04. Updated 2026-11-02._

## How it works
A liquidation pays out a bonus, fee or surcharge. The payout is derived from a value the attacker influences (a price the position owner sets, a repay amount the liquidator picks, an uncapped intermediate) or is paid on a code path that should have been disabled. The assumption that breaks is that the reward base is bounded and trusted, and that every liquidation entry point enforces the same guards. When it is not, the reward can exceed what the position can fund, so the shortfall is covered from reserves or by minting, or the reward is paid while bad debt is left behind.

## Where it shows up
- Reward = rate * price * size where price or size is set by the position owner or caller [E1](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md)
- Reward paid from a reserve or mint when the position is short of funds [E1](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md)
- Two liquidation paths (incentivized vs bad-debt) with guards in only one allowed-check [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AM-5.md)
- A safety branch whose condition depends on a caller-chosen repay amount [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-2.md)
- A fee computed from a pre-cap intermediate but subtracted from a post-cap value [E4](https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AM-3.md)
- Config that lets open, challenge and settle happen in one transaction [E1](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md)

## How to review
- For every reward formula, name the base and ask who controls it and whether it is bounded. The invariant: reward must be a function only of values the protocol bounds, and must never exceed the funds actually recovered from the position.
- Trace where the reward is paid from. If a shortfall reaches a reserve or mint, check that the shortfall cannot be forced by inflating the reward base [E1](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md).
- Enumerate all liquidation entry points and confirm each enforces pause/deprecation/health guards, not just the shared allowed-check [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AM-5.md).
- For each protective branch, check whether its condition uses a caller-supplied amount; if so, the caller can pick a value that satisfies the safe branch [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-2.md).
- Check that fee and cap use the same variable; test at extreme price drops (99%+) for underflow or revert that blocks liquidation [E4](https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AM-3.md).

## How finders spotted it
- Read the reward math in the settle function, noticed the reward derived from an owner-set price, and that the loss path mints when the position is short [E1](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md).
- Noticed the deprecation guard sat only in one allowed-check while the bad-debt path had its own, then confirmed with a PoC [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AM-5.md).
- Read the bad-debt branch and saw its condition depended on the attacker-controlled repay amount [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-2.md).
- Saw surcharge computed from an uncapped value but subtracted from a capped one, then tested a 99% crash [E4](https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AM-3.md).

## Variants seen
- Owner-inflated price feeding the challenger reward, draining reserves and minting [E1](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md)
- Deprecated market still paying incentive on the regular liquidation path [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AM-5.md)
- Caller-chosen partial repay dodging the bad-debt reward reduction [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-2.md)
- Uncapped surcharge underflowing at extreme price drops, blocking liquidation [E4](https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AM-3.md)

## Impact and severity
E1 is critical: reserve drain plus unlimited mint, made atomic and repeatable by zero challenge time [E1](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md). E2 lets liquidators profit while worsening protocol health on deprecated markets [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AM-5.md). E3 pays full reward while leaving bad debt [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-2.md). E4 blocks liquidation entirely after a 99% crash, leaving bad debt [E4](https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AM-3.md). Impact rises when the reward base is unbounded and the payout source is a reserve or mint [E1](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md), and when a guard covers only one of several paths [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AM-5.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-12-numa-audit%3AM-5.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-2.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AM-3.md