# Liquidation threshold and weight manipulation

Can a borrow, admin update, or weight change move thresholds and force healthy positions into liquidation?

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2024-09-03. Updated 2026-10-23._

## How it works
Liquidation safety depends on a threshold or weight that is supposed to reflect risk. The assumption that breaks is that this parameter is stable and independent of user or admin action. When a single borrow, an admin config change, or a weight update can move the threshold, positions that were healthy under the old value become liquidatable under the new one, with no price move required. The trigger is a parameter change, not market movement.

## Where it shows up
- Global safety modes (e.g. recovery mode) triggered by an aggregate LTV ratio that users can push past by borrowing [E1](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AH-04.md)
- A config value that doubles as both a risk weight and an eligibility flag, so zeroing it silently drops health [E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-11.md)
- Allocation or market weights whose zeroing is meant to "remove" an asset but leaves the position open [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-perennial-v2-3%3AM-1.md)
- Borrow paths that allow LTV above the safety-mode trigger but below liquidation
- Admin setters for thresholds/weights with no timelock or grace period
- Rebalance math where a weight multiplies collateral, collapsing it to a margin floor

## How to review
The invariant: a position's liquidation status must change only in response to price or accrued interest, never as a side effect of another user's borrow or an admin parameter write. Check that (1) safety-mode triggers cannot be crossed by borrowing alone, or borrowing is blocked above the trigger [E1](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AH-04.md); (2) each config value has one meaning, and disabling collateral is a separate explicit action with notice [E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-11.md); (3) zeroing a weight actually closes the position rather than leaving it at minPosition/maxPosition clamps [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-perennial-v2-3%3AM-1.md). Trace every setter and every borrow to the health calculation.

## Variants seen
- Aggregate-LTV-triggered recovery mode lowering per-trove thresholds, weaponized as leverage [E1](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AH-04.md)
- Admin zeroing liquidationThreshold to force arbitrary liquidations, MEV back-run [E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-11.md)
- Weight set to 0 leaving position at max leverage instead of closing it [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-perennial-v2-3%3AM-1.md)

## Impact and severity
Healthy positions became liquidatable, enabling forced liquidation and MEV capture [E1](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AH-04.md)[E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-11.md), or leaving positions at max leverage risking liquidation or a bricked vault [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-perennial-v2-3%3AM-1.md). Severity is high because the trigger is cheap and atomic; it worsens when the change is instant, unannounced, or reachable by any borrower.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AH-04.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-11.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-02-perennial-v2-3%3AM-1.md