# `borrowing::liquidate()` sends the wrong liquidation index to the destination chain, overwritting liquidation information and getting collateral stuck Crit/High · Sherlock · Hedged stablecoin · 4th December 2024 Finding H-20 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/775 --- ### Summary `borrowing::liquidate()` sends the `noOfLiquidations` variable as liquidation index to the other chain. However, liquidations are tracked in `omniChainData.noOfLiquidations`, on both chains. For example, if a liquidation happens on chain A, it increases to 1 and sends this information to chain B. If a liquidation happens on chain B, it will have index 2, not 1. ### Root Cause In `borrowing:402`, the wrong variable is sent as liquidation index to the other chain. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. Liquidation happens on chain A, incrementing `omniChainData.noOfLiquidations` to 1 and `noOfLiquidations` to 1 also. 2. Liquidation happens on chain B, [with index 2](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/borrowLiquidation.sol#L199) (it received the omnichain data from chain A and then incremented it). In chain B, it sends the liquidation info to chain A, but sends with index 1, not 2, as it uses the local `noOfLiquidations` to send the index. 3. Chain A will have liquidation info with index 1 overiwritten by the liquidation of chain B, leading to stuck collateral of the first liquidation in chain A (as long as depositors have not withdraw, but if they have, they can't withdraw the second liquidation anyway). ### Impact Stuck collateral. ### PoC See above. ### Mitigation Pass in the correct index, given by `omnichainData.noOfLiquidations`. --- Related findings: - [liquidateDefaultedLoanWithIncentive sends the collateral to the wrong account](https://0xsimao.com/findings/teller-finance-liquidate-defaulted-incentive-collateral): Teller Finance - [Send should revert if the gas limit has not been set for a destination chain (peer)](https://0xsimao.com/findings/metazero-i-revert-gas-destination-peer): MetaZero Omnichain NFTs - [triggerSendFrom() will send all the ETH in the destination chain where sendFrom() is called to the refundAddress in the LzCallParams argument](https://0xsimao.com/findings/tapioca-dao-eth-refund-params-argument): Tapioca DAO - [Exercise option cross chain message in the (m)TapiocaOFT will always revert in the destination, losing debited funds in the source chain](https://0xsimao.com/findings/tapioca-dao-exercise-revert-losing-debited): Tapioca DAO