Foundry DeFi Stablecoin CodeHawks Audit Contest

Summary

Function and action liquidate can be front run

Vulnerability Details

Liquidators are incentivized to act on user accounts that are not healthy in order to receive a bonus.
However, once a liquidator has sent a liquidation transaction other liquidators especially whales, more financed entities can monitor the memepool for this transaction and front run in order to gain the bonus less the gas fees if profitable.

Impact

This competition for liquidation can push out the regular and small users who are not armed or able to compete on gas for liquidations. A healthy project requires a large number of diverse liquidators who are active. If small players are pushed out this may impact the project. Take theoretically a big whale front runs all liquidations until other liquidators leave the protocol. When collateral prices fall and big whale does not act or actually sabotages by not liquidating the protocol is at risk. They may even take advantage of scenario of knowing they are main player so no liquidations will mean no stability and they can short the assets and or stablecoin in order to profit from this.

Tools Used

Manual Analysis

Recommendations

It is recommended users are well informed of these risks and directed to options like Flashbots.
Other aspects like building a strong community can also encourage liquidators to stay to ensure the stablecoin they are keen on maintains stability. However economics and game theory will say liquidators will go to where they can maximize profits so it is a challenging issue too. Maybe offer additional incentive token for liquidations etc