# Audit Liquidation

> Audits Solidity liquidation mechanisms for incentive structure vulnerabilities including missing liquidation rewards making trustless liquidation unprofitable, insufficient incentives for small positions causing bad debt accumulation, profitable users withdrawing collateral eliminating liquidation incentive, missing bad debt handling mechanisms, partial liquidation bypassing bad debt accounting, and lack of partial liquidation preventing whale position liquidations

- Skill: `auditmos/audit-liquidation` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add auditmos/audit-liquidation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/auditmos/audit-liquidation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: auditmos (https://skillmd.com/u/auditmos)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/auditmos/audit-liquidation

---


# Liquidation Incentive Auditor

## When to Use
- Auditing liquidation mechanisms, collateral management, position management
- User mentions: liquidation, incentive, reward, bonus, bad debt, partial liquidation, whale positions, insurance fund, socialization
- Analyzing liquidation profitability, bad debt handling, position sizing
- Reviewing collateral withdrawal restrictions, liquidation economics

## Audit Workflow

**IMPORTANT: Announce skill usage at the start of analysis**

Begin with: "I'm using the **audit-liquidation** skill to analyze this contract for liquidation incentive and bad debt handling vulnerabilities..."

1. **Scan for liquidation operations**
   - Search: `liquidate`, `liquidationBonus`, `liquidationReward`, `badDebt`, `insuranceFund`, `partialLiquidation`, `minPositionSize`
   - Focus: liquidation rewards, position minimums, collateral withdrawals, bad debt handling

2. **Check against vulnerability patterns**
   - Reference `reference.md` for complete checklist
   - Compare code against `example.md`

3. **Validate exploitability**
   - **Check access control first** - grep for `onlyOwner|onlyAdmin|onlyGovernance` modifiers
   - Can non-privileged actors exploit liquidation incentive issues?
   - Is liquidation profitable for trustless actors?
   - Can small positions accumulate as bad debt?
   - Can users withdraw collateral while maintaining underwater positions?
   - Is bad debt handled properly?
   - Verify no compensating protections exist
   - Downgrade severity if admin-only unless systemic bad debt risk

4. **Generate report**
   - Use deliverable template below
   - Include economic analysis and PoC
   - Rank by severity

## Core Vulnerability Patterns

See `reference.md` for full checklist. Key patterns:

1. No liquidation incentive → trustless liquidation unprofitable, positions remain underwater
2. No incentive for small positions → dust positions accumulate, protocol insolvent
3. Collateral withdrawal with positive PNL → removes liquidation incentive, positions unliquidatable
4. No bad debt mechanism → insolvent positions have no recovery path
5. Partial liquidation bypasses bad debt → liquidators extract value, protocol absorbs loss
6. No partial liquidation → whale positions exceed liquidator capacity, remain underwater

**Code examples:** See `example.md`

## Severity Criteria

**Critical:** No liquidation incentive causing systemic bad debt accumulation, collateral withdrawal eliminating liquidation possibility, **MUST be exploitable by non-privileged actors**
**High:** Missing bad debt handling mechanism, partial liquidation bypassing bad debt accounting, insufficient incentives for small positions, **MUST be exploitable by non-privileged actors**
**Medium:** Suboptimal liquidation rewards reducing liquidation speed, missing partial liquidation for large positions, **admin-only liquidation configuration issues with cascading bad debt risk**
**Low:** Inefficient reward structures without security impact, **admin-only parameter issues without immediate bad debt impact**

**IMPORTANT:** Admin-only liquidation functions (onlyOwner, onlyAdmin, onlyGovernance) are **MEDIUM or LOW severity** unless:
- Invalid reward parameters cause systemic liquidation failure and protocol insolvency
- Missing validation enables admin to manipulate liquidation incentives for personal gain
- Configuration errors directly lead to bad debt accumulation affecting all users

## False Positives - Do NOT Flag

- Protocols with trusted liquidators (not trustless)
- Minimum position sizes with explicit documentation
- Protocols with overcollateralization requirements preventing withdrawals
- Bad debt handling via documented manual admin intervention
- Fixed liquidation rewards with analysis showing profitability
- **Admin-only liquidation reward setters** (onlyOwner, onlyAdmin) in protocols with trusted admin and documented governance
- Governance-controlled incentive parameters with timelock and analysis showing profitability
- Admin functions for insurance fund management where bad debt socialization is documented

## Deliverable Format

**MANDATORY:** Before deliverable, verify each `checklist.md` item against codebase. Flag violations as findings.

Use template: `templates/report-template.md`

Each finding includes: severity, pattern #, file/lines, description, vulnerable code, economic impact analysis, PoC showing unprofitable liquidation or bad debt accumulation, remediation, gas impact.

## Key Principles

- **Profitability** - liquidation must be profitable vs gas costs for trustless actors
- **Minimum viability** - enforce minimums to ensure liquidation profitability
- **Collateral lock** - prevent withdrawals that eliminate liquidation incentive
- **Bad debt handling** - insurance fund or socialization for insolvent positions
- **Scalability** - partial liquidation for positions exceeding liquidator capacity

## Output Guidelines

**DO:**
- Reference specific lines and functions
- Provide economic analysis (gas costs vs rewards)
- Show PoCs demonstrating unprofitable liquidations
- Quantify bad debt accumulation potential
- Calculate minimum profitable position sizes

**DON'T:**
- Report intentional trusted liquidator designs
- Flag missing features with alternative mechanisms in place
- Use vague terms ("might be unprofitable")
- Ignore gas cost context and liquidation economics