Audit Liquidation

Liquidation Incentive Auditor

When to Use

• Auditing liquidation mechanisms, collateral management, position management
• User mentions: liquidation, incentive, reward, bonus, bad debt, partial liquidation, whale positions, insurance fund, socialization
• Analyzing liquidation profitability, bad debt handling, position sizing
• Reviewing collateral withdrawal restrictions, liquidation economics

Audit Workflow

IMPORTANT: Announce skill usage at the start of analysis

Begin with: "I'm using the audit-liquidation skill to analyze this contract for liquidation incentive and bad debt handling vulnerabilities..."

1. Scan for liquidation operations

   • Search: liquidate, liquidationBonus, liquidationReward, badDebt, insuranceFund, partialLiquidation, minPositionSize
   • Focus: liquidation rewards, position minimums, collateral withdrawals, bad debt handling

2. Check against vulnerability patterns

   • Reference reference.md for complete checklist
   • Compare code against example.md

3. Validate exploitability

   • Check access control first - grep for onlyOwner|onlyAdmin|onlyGovernance modifiers
   • Can non-privileged actors exploit liquidation incentive issues?
   • Is liquidation profitable for trustless actors?
   • Can small positions accumulate as bad debt?
   • Can users withdraw collateral while maintaining underwater positions?
   • Is bad debt handled properly?
   • Verify no compensating protections exist
   • Downgrade severity if admin-only unless systemic bad debt risk

4. Generate report

   • Use deliverable template below
   • Include economic analysis and PoC
   • Rank by severity

Core Vulnerability Patterns

See reference.md for full checklist. Key patterns:

1. No liquidation incentive → trustless liquidation unprofitable, positions remain underwater
2. No incentive for small positions → dust positions accumulate, protocol insolvent
3. Collateral withdrawal with positive PNL → removes liquidation incentive, positions unliquidatable
4. No bad debt mechanism → insolvent positions have no recovery path
5. Partial liquidation bypasses bad debt → liquidators extract value, protocol absorbs loss
6. No partial liquidation → whale positions exceed liquidator capacity, remain underwater

Code examples: See example.md

Severity Criteria

Critical: No liquidation incentive causing systemic bad debt accumulation, collateral withdrawal eliminating liquidation possibility, MUST be exploitable by non-privileged actors High: Missing bad debt handling mechanism, partial liquidation bypassing bad debt accounting, insufficient incentives for small positions, MUST be exploitable by non-privileged actors Medium: Suboptimal liquidation rewards reducing liquidation speed, missing partial liquidation for large positions, admin-only liquidation configuration issues with cascading bad debt risk Low: Inefficient reward structures without security impact, admin-only parameter issues without immediate bad debt impact

IMPORTANT: Admin-only liquidation functions (onlyOwner, onlyAdmin, onlyGovernance) are MEDIUM or LOW severity unless:

• Invalid reward parameters cause systemic liquidation failure and protocol insolvency
• Missing validation enables admin to manipulate liquidation incentives for personal gain
• Configuration errors directly lead to bad debt accumulation affecting all users

False Positives - Do NOT Flag

• Protocols with trusted liquidators (not trustless)
• Minimum position sizes with explicit documentation
• Protocols with overcollateralization requirements preventing withdrawals
• Bad debt handling via documented manual admin intervention
• Fixed liquidation rewards with analysis showing profitability
• Admin-only liquidation reward setters (onlyOwner, onlyAdmin) in protocols with trusted admin and documented governance
• Governance-controlled incentive parameters with timelock and analysis showing profitability
• Admin functions for insurance fund management where bad debt socialization is documented

Deliverable Format

MANDATORY: Before deliverable, verify each checklist.md item against codebase. Flag violations as findings.

Use template: templates/report-template.md

Each finding includes: severity, pattern #, file/lines, description, vulnerable code, economic impact analysis, PoC showing unprofitable liquidation or bad debt accumulation, remediation, gas impact.

Key Principles

• Profitability - liquidation must be profitable vs gas costs for trustless actors
• Minimum viability - enforce minimums to ensure liquidation profitability
• Collateral lock - prevent withdrawals that eliminate liquidation incentive
• Bad debt handling - insurance fund or socialization for insolvent positions
• Scalability - partial liquidation for positions exceeding liquidator capacity

Output Guidelines

DO:

• Reference specific lines and functions
• Provide economic analysis (gas costs vs rewards)
• Show PoCs demonstrating unprofitable liquidations
• Quantify bad debt accumulation potential
• Calculate minimum profitable position sizes

DON'T:

• Report intentional trusted liquidator designs
• Flag missing features with alternative mechanisms in place
• Use vague terms ("might be unprofitable")
• Ignore gas cost context and liquidation economics