Summary

There's no mechanism to account for specific user repaying their bad debt, so borrower or non-borrower(anyone) can repay all their bad debt without there being any internal accounting evidence for it.

Vulnerability Details

In below function any arbitrary msg.sender can repay all or portion of the bad debt, but there is clearly no internal or any other accounting to account for the specific msg.sender's repayment.

Impact

• Borrower with bad debt wont be able to be acknowledged when they repay their bad debt or a portion thereof, it will be equivalent to not having repaid anything.

Tools Used

VSCodium. Manual.

Recommendations

Add internal accounting to account for each msg.sender repaying their bad debt. Add it to the function in question.