DittoETH
Ditto
DeFiFoundryOracle
55,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Liquidation can be DOSed

nyx

Summary

Vulnerability Details

When liquidating a user, if the CR is already under minimumCR, liquidateSecondary() can be called without needing to first flagShort(). However, users can use this to gain an advantage with the combineShorts() function.

if (c.shortFlagExists) {
if (
firstShort.getCollateralRatioSpotPrice(
LibOracle.getSavedOrSpotOraclePrice(_asset)
) < LibAsset.primaryLiquidationCR(_asset)
) revert Errors.InsufficientCollateral();

combineShorts() function reverts when the new shorts collateral rate is < primaryLiquidationCR. But it only reverts if one of the shorts has flags. If any of the shorts don't have any flag (shorts with CR < minimunCR don't need to be flagged), combineShorts() function won't revert and users can DOS liquidation.

POC :
ShortsErcDebt.t.sol

function testCombineShorts() public {
//@audit
vm.prank(_diamond);
token.mint(extra, ercDebtTotal);
setETH(1000 ether);
​
vm.prank(sender);
combineShorts({
id1: Constants.SHORT_STARTING_ID,
id2: Constants.SHORT_STARTING_ID + 1
});
vm.expectRevert(Errors.MarginCallSecondaryNoValidShorts.selector);
liquidateWallet(
sender,
Constants.SHORT_STARTING_ID,
DEFAULT_AMOUNT * 2,
extra
); // c-ratio 0.75
​
// liquidateWallet(
// sender,
// Constants.SHORT_STARTING_ID + 1,
// (DEFAULT_AMOUNT * 3) / 2,
// extra
// ); c-ratio 1.0
}

Impact

Anyone can front-run the liquidation and DOS liquidation with the combineShorts() function and create bad debt.

Tools Used

Manual Review

Recommendations

Shorts with CR < minimumCR should not be allowed to combine with other shorts.

Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Other
nyx Submitter
almost 2 years ago
0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.