Summary

The purpose of liquidation is to punish the position owner for creating a risky position and rewarding the liquidator for keeping the protocol healthy. If the liquidator is the position owner, and the money comes back to him, then liquidation serves no purpose.

Vulnerability Details

The protocol has a permissionless liquidate function which allows anyone to liquidate anyone's position and will be rewarded with 10% of what they liquidated. For example, if the position owner has $10,000 worth of collateral and the DSC minted amount is $6,000 (166% collaterization ratio), he is subjected to liquidation because he is below the protocol's collaterization ratio of 200%. The liquidator pays back $3,000 worth of DSC and gets $3,300 worth of collateral back, meaning that he earned $300 (10%) by paying back $3,000 worth of DSC. The new position is now $6,700 collateral and $3,000 DSC, which gives a collateral ratio of 223% (the position becomes healthy again).

The position owner can liquidate himself so that he is not punished at all. If the position owner liquidates $3,000 of his own assets, he gets back $3,300 of his own assets, so this is akin to simply repaying back collateral, which defeats the purpose of liquidation.

Impact

There is no point of liquidation if the position owner pays back his own position

Tools Used

Manual Review

Recommendations

A simple recommendation is to give the protocol a small fee as well, so if the protocol owner decides to liquidate his own position, he still has to pay a small sum of fees to the protocol, and that will be his punishment for having his position be underwater. Also, liquidation can then differ from repaying collateral, otherwise it's just two same functions.