SharwaMarginTrading exploit analysis

SharwaMarginTrading's liquidate accepted a debtor argument from the caller without checking that the caller had authorisation to liquidate that debtor's position. The attacker called liquidate(self) repeatedly against any open position and walked the collateral out.

DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.

What would have prevented it: a liquidate keyed to a single account at a time, with any liquidation requiring a successful health check rather than a caller-supplied debtor.