The Standard

Summary

LiquidationPool::distributeAssets() has no access control and anyone can call the function. It has to have an owner or admin or manager access control to run the said function as intended and not ruin the workings of the protocol.

Vulnerability Details

The malicious actor/s could pass a value on the parameter _collateralRate such that when positions are calculated his/their position will be inflated.
Here's the said function for quick reference.

Impact

Malicious actors can gain from this and the losses will be absorbed by the honest users.

Tools Used

Manual Review

Recommendations

Create a modifier to control access or just use existing modifier onlyManager.