Skip to content
Request an audit

‹ All findings

ViewLogic::maxLiquidatable() doesn't take the bonus into account, making the agent liquidatable again

MediumCap·Sherlock · Stablecoin issuer · 10th July 2025CodebaseM-10

Source

Summary

ViewLogic::maxLiquidatable() computes the maximum debt to liquidate such that the resulting target health is exactly the desired:

solidity
maxLiquidatableAmount = (($.targetHealth * totalDebt) - (totalDelegation * liquidationThreshold)) * decPow
    / (($.targetHealth - liquidationThreshold) * assetPrice);

However, this is inaccurate due to the bonus, which affects the final health as it slashes more than the debt is repays.

Thus, it will trigger more than 1 liquidations in certain conditions and lead to heavy losses for the agent.

Root Cause

In ViewLogic.sol:91, it doesn't include the bonus.

Internal Pre-conditions

None

External Pre-conditions

None

Attack Path

  1. Agent is liquidated twice in a row due to the ViewLogic::maxLiquidatable() calculation not taking into account the bonus.

Impact

Agent suffers more losses than supposed.

Mitigation

Include the bonus in the debt to repay so the health factor equals the target.