After burning the user's debt, liquidate requires the ending health factor to be strictly greater than the starting one.
When a liquidator covers the user's entire debt, user_to_dsc_minted becomes 0, so _calculate_health_factor returns max_value(uint256) (dsc_engine.vy:324-325). If the starting health factor was already max_value for any rounding reason it cannot increase, and more importantly the > comparison plus the engine's lack of a debt_to_cover <= user_debt bound means an over-cover underflows user_to_dsc_minted (dsc_engine.vy:263) and reverts.
Likelihood:
Medium. Full liquidation is the normal way to clear a small underwater position; a liquidator passing debt_to_cover equal to or above the user's debt is the expected path.
Impact:
Medium. Liquidations of fully-underwater or fully-covered positions revert, so positions that should be cleared are stuck and the protocol accrues bad debt. It also makes liquidation bots fail unpredictably, reducing the system's ability to stay solvent.
Cover slightly more than the user's outstanding debt.
Bound debt_to_cover to the user's debt and compare health factors with >= where appropriate.
The contest is live. Earn rewards by submitting a finding.
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsThe contest is complete and the rewards are being distributed.