Summary

The canRemoveCollateral function allows users to remove part of their collateral and leave with loans up to the full amount of their collateral

Vulnerability Details

The aime collateralization rate of the protocol is 120% as mentioned by the Standard team. The maxMintable function is used to calculate the maximum amount of tokens that a user can borrow against their collateral:

It does so by calculating the value of the collateral in terms of EUROs and dividing it by the `collateralRate. For example:

1. A user deposited collateral which is equal to 600$ in terms of EUROs tokens.

2. maxMintable = 600 * 10 000 / 120 000 => 500.

The user can borrow max 500 tokens.

However, there are functionalities that allow the user to remove part of his collateral - removeCollateralNative, removeCollateral, removeAsset.

There is a require statement that makes sure enough collateral is left in the vault so the loan is not undercollaterized. The calculations are as follow:

Let's look at an example:

A user has deposited 600$ as collateral and borrowed 450$ in ERUROs tokens. Now the user wants to remove 150$ of collateral.

1. The maxMintable will be 500$ as it calculates the collateral in the vault no matter if it's already borrowed against.

2. eurValueToRemove will be 150$.

3. currentMintable >= eurValueToRemove (that's true as 500$ > 150 <= 600$ - 150$)

The user successfully removed 150$ of collateral and now have 450$ borrowed and 450$ collateral.

Impact

In the best-case scenario, the loan will be liquidated immediately. In the worst-case scenario, it will go unnoticed and the user can use a 100% loan.

Tools Used

Manual Review

Recommendations

Change the calculations in canRemoveCollateral so the loan is never undercollaterized. Moreover, the maxMintable should take into account only the collateral that was not borrowed against.