Skip to content
FORENSIAWeb3 forensicsOpen workspace
FORENSIAOpen workspace
Menu
← The field guide
DeFi / Illustrated lesson

Liquidation or exploit?
A forced sale is not automatically a theft.

Lending protocols can liquidate positions when their rules permit it. Reconstruct the collateral, debt, price inputs and liquidation call before deciding whether the action departed from those rules.

Reading history stays in this browser. Manage it in My Explore.
  1. 01

    A position crosses a threshold

  2. 02

    A liquidation action executes

  3. 03

    Debt and collateral change

Illustrative sequence. This diagram is a teaching aid, not a captured transaction.

What to collect

  1. Market version and risk parameters
  2. Relevant price and position state
  3. Liquidation call and asset changes
Before drawing a conclusion

A large collateral outflow alone does not establish a vulnerability. Historical state may be necessary to explain eligibility.

Test the idea

Collateral leaves a lending account. What else is needed before calling it a drain?

Reveal the explanation

Inspect the liquidation rules, relevant state and debt changes. The transfer may be part of an authorized liquidation.

Try a practice scenario ↗