Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Users with healthFactor smaller than 0.55 can't get liquidated

alexczm

Summary

liquidate is used to liquidate users with healthFactor < MIN_HEALTH_FACTOR (1e18).
If healthFalctor drops to < 0.55, user can't get liquidated due to the fixed 10% liquidation bonus.

Vulnerability Details

liquidate will calculate the totalCollateralToRedeem to liquidate based on debtToCover and adds a 10% liquidation incentive.
If user collateral value drops from > 200% (for a healthy healthFactor) to < 110% (corresponding to a healthyFactor of < 0.55), that user can't get liquidated due to underflow in _redeemCollateral :
s_collateralDeposited[from][tokenCollateralAddress] -= amountCollateral;

Add import {stdError} from "forge-std/StdError.sol"; to DSCEngine.t.sol;
Add above code to DSCEngine.t.sol file;
Run forge test --mt testLiquidateReverts -vvv;

modifier liquidateUnderflow() {
vm.startPrank(user);
ERC20Mock(weth).approve(address(dsce), amountCollateral);
dsce.depositCollateralAndMintDsc(weth, amountCollateral, amountToMint);// mint 100 DSC
vm.stopPrank();
int256 ethUsdUpdatedPrice = 10.9e8; // 1 ETH = $10.9 => healthFactor = 0.545 * 1e18
MockV3Aggregator(ethUsdPriceFeed).updateAnswer(ethUsdUpdatedPrice);
uint256 userHealthFactor = dsce.getHealthFactor(user);
console.log("HealthFactor", userHealthFactor);
ERC20Mock(weth).mint(liquidator, collateralToCover);
vm.startPrank(liquidator);
ERC20Mock(weth).approve(address(dsce), collateralToCover);
dsce.depositCollateralAndMintDsc(weth, collateralToCover, amountToMint);
dsc.approve(address(dsce), amountToMint);
vm.expectRevert(stdError.arithmeticError);
dsce.liquidate(weth, user, amountToMint); // We are covering their whole debt
vm.stopPrank();
_;
}
​
function testLiquidateReverts() public liquidateUnderflow {}

Impact

Users with a health factor under a certain threshold (0.55) can't get liquidated. This increase the chances protocol becomes insolvent.

Tools Used

Manual review, Foundry

Recommendations

Allow liquidation to happen even if healthFactor is in [0.5, 0.55) interval (0.5 <= userHealthFactor < 0.55): clear user debt and send his collateral amount to liquidator. Liquidator will get a smaller % bonus in this case.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.