# Wrong collateral identity in liquidation

Liquidation values or seizes a token, chain, registry or price that differs from where the collateral lives

_Area: DeFi oracles, liquidations and flash loans. Seen in 6 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
Liquidation assumes the token address, chain, registry, price source and lifecycle flag it reads all describe the collateral being seized. When a protocol spans chains, markets or collateral registries, that assumption breaks: a payload field from another chain's address space, a registry the loop never iterates, or a price source the core market does not use gets substituted for the real one. The invariant: the valuation and identity context used at liquidation must match the collateral's actual market, chain and registry.

## Where it shows up
- Cross-chain payload fields echoed back and used to match stored collateral records [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-14.md)
- Collateral split across multiple registries, with loops iterating only one [E2](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-09.md)
- Liquidation price source differing from the core market's price source [E3](https://bugbountylibrary.com/r/sherlock%3A2023-09-perennial%3AM-7.md)
- Seize hooks that skip a check that the asset is still enabled collateral [E4](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-06.md)
- Liquidation path that only updates accounting while user paths do real token transfers [E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-11.md)
- Lifecycle flags (active/inactive) consumed inconsistently between borrow accounting and liquidation [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-29.md)
- Seize-token math run on the destination chain's exchange rate for collateral held on the source chain [E7](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-5.md)

## How to review
For each liquidation path, trace every identifier and value back to its origin:
- For each payload field, record which chain's address space it belongs to and whether it round-trips unchanged [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-14.md).
- For each collateral registry, confirm every liquidation loop iterates all registries that aggregation functions read [E2](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-09.md).
- For each rate/price lookup, name the chain and market it reads and confirm it is the one holding the collateral [E3](https://bugbountylibrary.com/r/sherlock%3A2023-09-perennial%3AM-7.md)[E7](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-5.md).
- Confirm seize hooks verify the asset is still enabled collateral [E4](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-06.md).
- Compare liquidation against user paths: does one transfer tokens while the other only updates accounting? [E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-11.md)
- Confirm active/inactive flags are checked identically in borrow accounting and liquidation [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-29.md).
False-positive risk: legitimately mirrored-token or multi-registry designs may look divergent; confirm the mapping is intentional and consistent end-to-end.

## Variants seen
- Destination-chain borrowed token used as srcToken, so collateral lookup fails and repayment reverts after seizure [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-14.md)
- Liquidation loop omits a collateral registry, shortchanging the liquidator [E2](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-09.md)
- Liquidation priced off a stale/wrong oracle rather than the market's valid price [E3](https://bugbountylibrary.com/r/sherlock%3A2023-09-perennial%3AM-7.md)
- Missing membership check lets liquidators seize exited collateral [E4](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-06.md)
- Accounting-only liquidation proceeds while paused-token user paths revert [E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-11.md)
- Inactive reserve counted for borrowing but rejected in liquidation, blocking seizure [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-29.md)
- Seize amount computed with the wrong chain's exchange rate [E7](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-5.md)

## Impact and severity
Outcomes range from unjust liquidation and wrong seize amounts [E2](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-09.md)[E4](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-06.md)[E7](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-5.md) to blocked liquidation leaving bad debt unliquidated [E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-11.md)[E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-29.md), and reverts after collateral is seized [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-14.md). Severity rises where the divergence is silent (matching symbols, mirrored addresses) and where one path keeps working while the other is blocked [E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-11.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-14.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-09.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-09-perennial%3AM-7.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AM-06.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-11.md
- E6: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-29.md
- E7: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-5.md