Summary

Faulty logic in the liquidate() function allows the liquidated user to retain his DSC even though he has no more collateral.

Vulnerability Details

The correct logic can be observed in burnDSC, where burning DSC removes the amount of DSC from both the balance and the state variable. This is achieved by giving _burnDSC identical inputs of msg.sender msg.sender

However, in the liquidate() function the inputs for _burnDSC are not the same, which breaks the logic of the system.

DSC is removed from the balance of the liquidator but not for the user. This means the user retains all his DSC even though his position was liquidated and he has no more collateral.

POC in Github Gist

Impact

The possibility of having DSC without any collateral breaks the system and makes the stablecoin worthless.

Tools Used

Manual review, Foundry

Recommendations

Create a separate _burnDSC function for liquidation wherein the DSC balance of both the user & liquidator is correctly deducted.