# Profitable self-liquidation in lending Can one actor be borrower and liquidator, and does the bonus exceed the cost of reaching the liquidation edge? _Area: DeFi oracles, liquidations and flash loans. Seen in 12 disclosed reports; one confirmed bounty: $180,000; latest 2026-08-28. Updated 2026-10-23._ ## How it works Liquidation assumes borrower and liquidator are separate actors with opposing interests: a third party closes an unhealthy position and earns a bonus for taking the risk. When one actor controls both sides, the bonus becomes a payment the protocol makes to itself. The borrower moves their own position to or past the liquidation edge, liquidates it, and captures the bonus (and, in some designs, more collateral than the debt repaid). Profitability needs only that the liquidation bonus plus any price or swap gain the actor controls exceeds the cost of opening and closing the position. In oracle-triggered variants the actor does not push the position; a price move does it, and the actor merely opens at max leverage beforehand. ## Where it shows up - Liquidation entry points with no check that `liquidator != borrower` [E4](https://bugbountylibrary.com/r/dhl%3A20260310-alkemiearn.md). - Withdraw math using aggregate obligation ratios instead of the withdrawn reserve's own LTV, letting a high-LTV asset be pulled out while debt stays [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-port-finance-logic-error-bugfix-review.md). - Solvency checked only against a maintenance threshold, with no separate initial-margin gate, so a position can be parked exactly at the liquidation edge [E3](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-2.md)[E8](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AM-6.md). - Seize-token math that rounds in the liquidator's favor when collateral and debt are near-equal [E6](https://bugbountylibrary.com/r/dhl%3A20231101-onyxprotocol.md). - Oracle-free designs where auction/bucket prices derive only from internal pool state [E2](https://bugbountylibrary.com/r/dhl%3A20260828-ajnafinance.md). - Fixed liquidation incentive with immutable per-market LLTV, where one oracle move flips a max-LLTV position unhealthy [E5](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.1.md)[E7](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.7.md). ## How to review Establish the invariant: for any single actor, the net value of open-then-self-liquidate must be non-positive. Concretely check that (a) the liquidator cannot be the borrower or a controlled alias [E4](https://bugbountylibrary.com/r/dhl%3A20260310-alkemiearn.md); (b) every collateral withdrawal path applies the withdrawn asset's own LTV, not an aggregate ratio [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-port-finance-logic-error-bugfix-review.md); (c) the strictest threshold (initial/margined) gates all position-changing paths, not just pending ones [E3](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-2.md)[E8](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AM-6.md); (d) worst-case compounded oracle deviation across chained feeds is below `1/LIF - LLTV` [E5](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.1.md); (e) a single oracle update cannot make a freshly opened max-LLTV position liquidatable at a profit [E7](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.7.md); (f) seize-token rounding never returns more collateral value than debt repaid [E6](https://bugbountylibrary.com/r/dhl%3A20231101-onyxprotocol.md). ## Variants seen - Withdraw-all-then-self-liquidate via wrong LTV in max-withdraw formula [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-port-finance-logic-error-bugfix-review.md). - Oracle-free internal pricing shaped by an actor who is both borrower and taker [E2](https://bugbountylibrary.com/r/dhl%3A20260828-ajnafinance.md). - One-transaction open-and-liquidate bypassing efficiency/liquidity limits [E3](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-2.md)[E8](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AM-6.md). - Missing self-liquidation guard plus flash-loan-inflated borrow balance [E4](https://bugbountylibrary.com/r/dhl%3A20260310-alkemiearn.md). - Precision-loss seize math favoring self-liquidation [E6](https://bugbountylibrary.com/r/dhl%3A20231101-onyxprotocol.md). - Oracle-deviation arbitrage in high-LLTV markets, triggered by the oracle rather than the borrower [E5](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.1.md)[E7](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.7.md). ## Why fixes fail Partial fixes that guard only the pending position while settled positions use a looser threshold leave the edge reachable [E3](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-2.md). ## Impact and severity Drains ranged from 43 ETH to $20-25M [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-port-finance-logic-error-bugfix-review.md)[E4](https://bugbountylibrary.com/r/dhl%3A20260310-alkemiearn.md). Severity is high: losses are direct protocol funds or socialized bad debt. Flash loans remove capital cost [E4](https://bugbountylibrary.com/r/dhl%3A20260310-alkemiearn.md), and fixed bonuses with immutable LLTV widen the profitable window [E7](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.7.md). ## Evidence - E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-port-finance-logic-error-bugfix-review.md - E2: https://bugbountylibrary.com/r/dhl%3A20260828-ajnafinance.md - E3: https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-2.md - E4: https://bugbountylibrary.com/r/dhl%3A20260310-alkemiearn.md - E5: https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.1.md - E6: https://bugbountylibrary.com/r/dhl%3A20231101-onyxprotocol.md - E7: https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.7.md - E8: https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AM-6.md