DSCEngine.liquidate()
does not check if user
is same as msg.sender
.
A user can mint more stablecoin to make his position liquiditable then call liquidate()
for himself.
https://github.com/Cyfrin/2023-07-foundry-defi-stablecoin/blob/main/src/DSCEngine.sol#L229-L238
Self-liquidation will get user addition liquidation reward rather than repaying and redeeming collateral.
Manual Review
DSCEngine.liquidate()
should revert if msg.sender
is same as user
.
https://github.com/Cyfrin/2023-07-foundry-defi-stablecoin/blob/main/src/DSCEngine.sol#L229-L238
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.