# Audit Unfair Liquidation

> Audits Solidity liquidation mechanisms for unfair liquidation vulnerabilities including missing L2 sequencer grace periods, interest accumulation while paused, repayment paused while liquidation active, late interest/fee updates, lost positive PNL/yield during liquidation, unhealthier post-liquidation state from cherry-picking, corrupted collateral priority, borrower replacement misattribution, n…

- **Type:** Skill
- **Install:** `agentstack add skill-auditmos-skills-audit-unfair-liquidation`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [auditmos](https://agentstack.voostack.com/s/auditmos)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [auditmos](https://github.com/auditmos)
- **Source:** https://github.com/auditmos/skills/tree/main/skills/audit-unfair-liquidation
- **Website:** https://auditmos.com

## Install

```sh
agentstack add skill-auditmos-skills-audit-unfair-liquidation
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Unfair Liquidation Auditor

## When to Use
- Auditing liquidation fairness, L2 deployments, pause mechanisms
- User mentions: L2 sequencer, grace period, pause, interest accumulation, LTV gap, auction, slippage protection, collateral priority
- Analyzing liquidation timing, state synchronization, user protections
- Reviewing pause/unpause logic, sequencer checks, health score calculations

## Audit Workflow

**IMPORTANT: Announce skill usage at the start of analysis**

Begin with: "I'm using the **audit-unfair-liquidation** skill to analyze this contract for unfair liquidation vulnerabilities..."

1. **Scan for liquidation fairness issues**
   - Search: `sequencer`, `paused`, `accrue`, `LTV`, `auction`, `healthFactor`, `slippage`, `collateralPriority`, `borrower`
   - Focus: sequencer checks, pause states, interest accrual, health calculations, auction mechanics

2. **Check against vulnerability patterns**
   - Reference `reference.md` for complete checklist
   - Compare code against `example.md`

3. **Validate exploitability**
   - **Check access control first** - grep for `onlyOwner|onlyAdmin|onlyGovernance` modifiers
   - Can non-privileged actors exploit unfair liquidation mechanisms?
   - Can users be liquidated during sequencer downtime without grace period?
   - Does interest accumulate while repayments paused?
   - Can liquidators cherry-pick stable collateral?
   - Is there an LTV gap between borrow and liquidation?
   - Verify no compensating protections exist
   - Downgrade severity if admin-only unless direct borrower harm

4. **Generate report**
   - Use deliverable template below
   - Include timing analysis and PoC
   - Rank by severity

## Core Vulnerability Patterns

See `reference.md` for full checklist. Key patterns:

1. Missing L2 sequencer grace period → users liquidated immediately when sequencer restarts
2. Interest accumulates while paused → users liquidated for interest accrued during downtime
3. Repayment paused, liquidation active → users prevented from avoiding liquidation
4. Late interest/fee updates → isLiquidatable uses stale values
5. Lost positive PNL/yield → profitable positions lose gains during liquidation
6. Unhealthier post-liquidation → liquidator cherry-picks stable collateral
7. Corrupted collateral priority → liquidation order doesn't match risk
8. Borrower replacement misattribution → original borrower repays new owner's debt
9. No LTV gap → users liquidatable immediately after borrowing
10. Interest during auction → borrowers accrue interest while being auctioned
11. No liquidation slippage protection → liquidators can't specify minimum rewards

**Code examples:** See `example.md`

## Severity Criteria

**Critical:** Missing sequencer grace period on L2, repayment paused while liquidation active, immediate liquidation after borrow (no LTV gap), **MUST be exploitable by non-privileged actors**
**High:** Interest accumulation during pause, late fee updates, cherry-picking collateral leaving unhealthier state, **MUST be exploitable by non-privileged actors**
**Medium:** Lost PNL/yield during liquidation, interest accrual during auctions, no liquidator slippage protection, **admin-only liquidation timing configuration issues with cascading borrower impact**
**Low:** Suboptimal collateral priority without security impact, **admin-only parameter issues without immediate borrower impact**

**IMPORTANT:** Admin-only liquidation timing functions (onlyOwner, onlyAdmin, onlyGovernance) are **MEDIUM or LOW severity** unless:
- Admin can trigger liquidations during sequencer downtime without grace period
- Pause mechanism controlled by admin creates asymmetry (repayment paused, liquidation active)
- LTV configuration by admin allows immediate liquidation after borrowing

## False Positives - Do NOT Flag

- L1-only deployments (no sequencer concerns)
- Protocols with explicit admin-only liquidation during pause
- Systems where pause simultaneously halts interest and liquidation
- Documented grace periods after unpause events
- Single-collateral systems (no cherry-picking possible)
- **Admin-only pause functions** (onlyOwner, onlyAdmin) where pause halts both repayment and liquidation symmetrically
- Governance-controlled LTV parameters with documented gap between borrow and liquidation thresholds
- Admin functions for grace period configuration with reasonable defaults

## Deliverable Format

**MANDATORY:** Before deliverable, verify each `checklist.md` item against codebase. Flag violations as findings.

Use template: `templates/report-template.md`

Each finding includes: severity, pattern #, file/lines, description, vulnerable code, timing/fairness analysis, PoC, remediation.

## Key Principles

- **Fairness** - users must have opportunity to avoid liquidation
- **Synchronization** - pause states must be consistent (repay ↔ liquidate)
- **Grace periods** - time for users to respond after downtime
- **Health improvement** - liquidation must improve borrower health
- **Predictability** - liquidators need slippage protection

## Output Guidelines

**DO:**
- Reference specific lines and functions
- Provide timing analysis (sequencer downtime windows)
- Show PoCs demonstrating unfair liquidation scenarios
- Analyze pause state interactions
- Calculate LTV gaps and health score changes

**DON'T:**
- Report intentional pause-based liquidation designs
- Flag missing features with alternative mechanisms
- Use vague terms ("might be unfair")
- Ignore documented grace period configurations

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [auditmos](https://github.com/auditmos)
- **Source:** [auditmos/skills](https://github.com/auditmos/skills)
- **License:** MIT
- **Homepage:** https://auditmos.com

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-auditmos-skills-audit-unfair-liquidation
- Seller: https://agentstack.voostack.com/s/auditmos
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.