Summary

Users can deposit assets to obtain DecentralizedStableCoin, use DecentralizedStableCoin to liquidate other people's assets for profit, and then redeem assets directly

Vulnerability Details

Because only the sender’s DecentralizedStableCoin amount is checked during redemption, but the sender's DecentralizedStableCoin amount has been burned during liquidation, so the user can deposit assets to obtain DecentralizedStableCoin, use DecentralizedStableCoin to liquidate other people's assets for profit, and then redeem assets directly.

https://github.com/Cyfrin/2023-07-foundry-defi-stablecoin/blob/main/src/DSCEngine.sol#L183

Impact

Users can deposit assets to obtain DecentralizedStableCoin, use DecentralizedStableCoin to liquidate other people's assets for profit, and then redeem assets directly

Tools Used

vs code

Recommendations

I think this is a design problem, I suggest author should redesign it in the liquidation function