Foundry DeFi Stablecoin CodeHawks Audit Contest

Summary

The liquidate() function allows users to liquidate either the entirety or a portion of the position, provided the collateral value of the position ranges between 200% and 110% of the DSC amount. However, once the value drops below 110% of the DSC amount, the position largely becomes immobile and cannot be liquidated.
If unliquidatable positions like this accumulate, they could lead to a potential insolvency for the entire protocol, which can trigger a mass sell-off.
There is also the case of a sudden drop in the price value.

Vulnerability Detail

Once the collateral value falls below 110% of the debt value, the position cannot be fully repaid. In cases where a liquidator decides to repay 100% of the debt, the 10% bonus will cause the following line to revert:
s_collateralDeposited[from][tokenCollateralAddress] -= amountCollateral;

Positions like this could potentially gradually accumulate and pose a systemic risk to the entire protocol and may lead to a "bank run" scenario where holders rush to redeem their stablecoins for collateral, further devaluing the stablecoin.

Also, in the case of a sudden drop in the value of the collateral tokens, the unsolvency risk becomes imminent as all the positions will be impacted at the same time.

Impact

The complete or partial inability to liquidate positions can lead to systemic insolvency and could trigger a bank run scenario, where holders rush to redeem their stablecoins for collateral, causing further devaluation of the stablecoin.

Tools Used

A thorough examination of the code base was performed to identify this issue.

Recommendation

To prevent a sudden drop in collateral value and or unliquidatable positions, the following protective measures should be added:

1. Automate the total position's liquidation by selling the collateral for DSC when the collateral total value in USD approaches 110% of the total debt value. This can be achieved by auctioning/exchanging the tokens. Consider utilizing Chainlink keepers for automating this process.

2. Implement a stability fee to regulate the creation/holding of DSC, thereby managing its supply.

3. Create a backstop mechanism where additional liquidity is used to cover the remaining debt (only if the protocol becomes illiquid).

4. Use correlation as a risk metric when choosing the collateral basket (this will be further explained in the Risk Management section).