# ClearingHouseLiq::_assertLiquidationAmount() may increase basis points due to negative quoteBalance.amount + insurance Crit/High · Three Sigma · Hybrid orderbook DEX · 3rd April 2024 Finding 3S-Vertex-C01 of the Vertex security review. - Report: /reports/vertex - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-04-03-vertex.pdf --- ### Description If the position is a spread, it may be liquidated as one up to the minimum absolute value of the spot and perp positions. If the spot is short, the liquidatee + insurace need to have enough quote to buy back the spot position. This [check](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/blob/main/contracts/ClearinghouseLiq.sol#L188-L193) is performed in ```solidity ClearingHouseLiq::_assertLiquidationAmount(): ... ``` basisAmount = MathHelper.max( -((quoteBalance.amount + insurance).div( liquidationPrice ) + 1), basisAmount ```solidity ); ... ``` Note that quoteBalance.amount + insurance may be negative, which would mean that abs(basisAmount) could be increased, leading to incorrect states. ### Recommendation Add if (quoteBalance.amount + insurance <= 0) basisAmount = 0 or similar. ### Status Addressed in [#38bbe76](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/commit/38bbe768d64139b9de91a065f4bdd1cb1e212198). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Price formula in `TpdaLiquidationPair._computePrice()` does not account for a jump in liquidatable balance](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-price-tpda-liquidation-compute): PoolTogether Prize Layer - [Liquidation will reduce total cds deposited amount, leading to incorrect option fees](https://0xsimao.com/findings/autonomint-liquidation-reduce-option-fees): Autonomint - [Missing Update to `omnichain.totalAvailableLiquidationAmount` in `withdrawUser`](https://0xsimao.com/findings/autonomint-omnichain-available-liquidation-withdraw): Autonomint - [Type 1 borrower liquidation will incorrectly add cds profit directly to `totalCdsDepositedAmount`](https://0xsimao.com/findings/autonomint-type-liquidation-directly-deposited): Autonomint