Foundry DeFi Stablecoin CodeHawks Audit Contest

Summary

You cannot liquidate a user that is below 110% overcollateralized.

Vulnerability Details

In the DSCEngine contract in the liquidate function if you try to liquidate a user that is below 110% overcollateralized the EVM will revert with Arithmetic over/underflow. This is because of the bonus that the liquidator should get(10%). Let's say that a user has deposited 1 token worth 210$ and then mints 100$ worth of DSC or 100 DSC. Now suppose the price of that token falls to 105 of debt divided by 105$ which is the price of the token) - 0.9523809523809524 with the bonusCollateral which is 10% of the tokenAmountFromDebtCovered and equals 0.0952380952380952. Now the sum of this two would be 1.047619047619048 which is greater than the deposited tokens of the user. And when trying to subtract the user's amount of tokens with the tokens that should be transferred to the liquidator, the EVM reverts with that error.

Impact

The token price can continue to fall and reach the point where the collateral is less than the amount of DSC minted and then the DSC token depegs. Now 1DSC doesn't equal 1$ which is disastrous for the stablecoin.

Proof Of Concept

You can add this test to the unit tests of the project and run it to see the issue:
function testLiquidatingUserThatIsBelow110PercentCollateralized() public {
vm.startPrank(user);
ERC20Mock(weth).approve(address(dsce), amountCollateral);
dsce.depositCollateralAndMintDsc(weth, amountCollateral, amountToMint);
vm.stopPrank();

    int256 ethUsdUpdatedPrice = 105e7; // 1 ETH = $10,50
    MockV3Aggregator(ethUsdPriceFeed).updateAnswer(ethUsdUpdatedPrice);

    ERC20Mock(weth).mint(liquidator, collateralToCover);

    vm.startPrank(liquidator);
    ERC20Mock(weth).approve(address(dsce), collateralToCover);
    dsce.depositCollateralAndMintDsc(weth, collateralToCover, amountToMint);
    dsc.approve(address(dsce), amountToMint);
    dsce.liquidate(weth, user, amountToMint);
    vm.stopPrank();
}

Recommendations

Add a check after calculating the totalCollateralToRedeem, to see if the user actually has this funds and if he doesn't have the funds, just grab his total collateral deposited and continue with the rest of the code.

Tools

Visual Studio Code, Foundry

Note

We are talking for users that are in the range of 109% to 101% overcollateralized.