Liquidation lacks a close-factor cap or health re-check, allowing a full position to be seized in one call, or a borrower to self-liquidate at a favorable bonus to extract the incentive from the protocol.
// borrower opens a position, then self-liquidates it, collecting the // 8% liquidation bonus paid by the protocol -> risk-free skim.
require(healthFactor(user) < 1e18, "healthy"); require(repay <= debt * CLOSE_FACTOR / 1e18, "too much");
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0222 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.