Users can avoid being liquidated.
principal comes from borrowBalanceStored(), fetch user's current borrow balance.
liquidated comes from accountTokens[user], get current amount for a user that will transfer to the liquidator.
borrowBalanceStored() is obtained through borrowBalanceStoredInternal() in MToken.sol.
The borrow balance of the account is calculated using the value of accountBorrows[user], and then returned.
liquidated is taken from accountTokens[user].
In MToken.sol, accountTokens[user] is affected by functions like mintFresh, redeemFresh, transferTokens, etc.
Consider this scenario :
a user is about to be liquidated by an admin using fixUser().
The user can front-run and use transfer() ,
transferring the balance of accountTokens[user] to avoid being liquidated.
transfer > transferTokens
user's current borrow balance become 0
accountBorrows[user].principal = 0
even if user's liquidated's value == 0
Users won't lose any tokens, the borrow balance will be zero.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.