Summary

The liquidate function is susceptible to frontrunning, as it does not have a mechanism to verify who acted on the undercollateralized position first.

Vulnerability Details

The function allows a user to liquidate undercollateralized positions by paying off a portion of the debt and receiving collateral plus a bonus in return. It can be called by anyone who can cover the debt. However, it's susceptible to frontrunning because anyone observing the transaction pool can submit a similar transaction with a higher gas fee to be processed first.

Impact

This vulnerability could lead to unfair advantages for users with higher resources to pay for gas fees, potentially undermining the fairness and integrity of the system.

Tools Used

Manual review

Recommendations

Enhance the transaction processing rules to prevent frontrunning