The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Some tokens could block all the liquidations

tripathi

Summary

Vaults, when undercollateralized, face liquidation through LiquidationPoolManager. However, the protocol's use of tokens that revert on zero transfer will block all liquidation

Vulnerability Details

function runLiquidation(uint256 _tokenId) external {
//...
LiquidationPool(pool).distributeAssets{value: ethBalance}(assets, manager.collateralRate(), manager.HUNDRED_PC());
//...
}
​

https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPoolManager.sol#L80
Seeing a vault's undercollateralised position runLiquidation() is called which invokes LendingPool.distributeAssets()

function distributeAssets(
ILiquidationPoolManager.Asset[] memory _assets,
uint256 _collateralRate,
uint256 _hundredPC
) external payable {
//...
for (uint256 j = 0; j < holders.length; j++) {
//...
for (uint256 i = 0; i < _assets.length; i++) {
//...
if (asset.amount > 0) {
​
uint256 _portion = (asset.amount * _positionStake) / stakeTotal;
//...
if (asset.token.addr == address(0)) {
nativePurchased += _portion;
} else {
// Vulnerability: Possible reversion on zero transfer
IERC20(asset.token.addr).safeTransferFrom(
manager,
address(this),
_portion
);
}
}
}
}
//...
}
​

https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPool.sol#L219

https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPool.sol#L232

The vulnerability lies in the possibility of a small position of a collateral token being set, which reverts during a zero-transfer scenario, making _portion = (asset.amount * _positionStake) / stakeTotal evaluate to zero (e.g., asset.amount ≈ 1 wei). This triggers a revert during the safeTransferFrom() operation, preventing liquidation.

Impact

No Liquidation can take a place if collateral tokens revert on zero transfer

Tools Used

Manual

Recommendations

Prior to transferring tokens, include a check to ensure the amount being transferred is nonzero

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.