Steadefi

Summary

The emergencyClose() function calls repay() to unwind the borrow position, but does not validate that the repayment completed successfully.

Vulnerability Details

If repay() reverts or fails to fully repay the borrowed assets for any reason, the contract state and borrow would be left in an inconsistent, partially repaid state.

Reproduction Steps:

1. Call emergencyClose() during exploit of repay()

2. repay() reverts or does not fully repay amounts

3. Function does not detect repay() failure

4. Borrow position remains outstanding

Impact

Borrower could retain access to loaned assets after attempted close

Tools Used

Manual Review

Recommendations

Validate repay() executes fully by checking borrow balances are zeroed. Revert state on any validation failures to avoid partial closures leaving funds exposed.