The Standard

Summary

A user can still deposit into a vault after being undercollateralized and liquidated losing his funds in the process.

Vulnerability Details

The SmartVaultManager only ensures a user is unable to mint or burn after being liquidated. However, a vault user can still deposit into the vault after seeing that he is undercollateralized to beat liquidation. As a result, a vault user can lose his funds.

Here's a practical scenerio:

• Vault user sees that he is undercollateralized and wants to deposit into the vault

• Before the user deposits into the vault, SmartVaultManager or liquidator called the liquidate and liquidateVault functions.

• Vault is liquidaed and blocked from minting and burning as a result

• Unknowingly, vault user deposits into the vault

• Vault user cannot mint or burn or withdraw newly deposited collateral

Impact

Loss of funds

Tools Used

Manual review

Recommendations

Vault user should also be blocked from being able to deposit after liquidation