Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: high

DOS: Liquidator health factor takes a hit from participating in the liquidation process

dliteofficial

Summary

Incorrect Accounting during liquidation would affect the liquidator's Health Factor.

Vulnerability Details

When a liquidator triggers a liquidation on a defaulter, two important functions are executed: _redeemCollateral and _burnDSC. The _redeemCollateral function transfers the amount equivalent to liquidate::debtToCover plus a 10% incentive from the defaulter to the liquidator.

_redeemCollateral(user, msg.sender, collateral, totalCollateralToRedeem);
// We need to burn the DSC
_burnDsc(debtToCover, user, msg.sender);

Additionally, the function invokes _burnDSC, which contains a flaw in its accounting. While the user's DSC is burned, the DSC of the liquidator is merely transferred. Consequently, the balance of the liquidator's DSC is not reduced; the tokens are simply transferred without proper reduction.

function _burnDsc(uint256 amountDscToBurn, address onBehalfOf, address dscFrom) private {
s_DSCMinted[onBehalfOf] -= amountDscToBurn;
bool success = i_dsc.transferFrom(dscFrom, address(this), amountDscToBurn);
// This conditional is hypothtically unreachable
if (!success) {
revert DSCEngine__TransferFailed();
}
i_dsc.burn(amountDscToBurn);
}

Impact

The issue becomes evident when the liquidator attempts to redeem their DSC for collateral, as they will find it impossible to withdraw their entire DSC balance. The reason is that they are required to transfer that amount back into the contract, an amount they don't have due to their participation in the liquidation process.

Tools Used

Manual Review

Recommendation

Instead of solely transferring the tokens out of the liquidator's balance, it is advised to also deduct the amount of DSC used in liquidation from the balance in the contract storage. This adjustment will help resolve the problem and ensure proper functionality.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.