Moonwell
Moonwell
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

`fixUser()` only fully liquidates and ignores Close Factor.

ljj

Summary

fixUser() only fully liquidates and ignores Close Factor.

Vulnerability Details

Moonwell is a fork of Compound. In Compound liquidations are done in a partial way to only pay a certain amount of their debt, this is called a Close Factor.
Compound docs on Close Factor: https://docs.compound.finance/v2/comptroller/#close-factor

In Moonwell this is implemented in Comptroller.sol example of Close Factor being used is in liquidateBorrowAllowed() function.

/* The liquidator may not repay more than what is allowed by the closeFactor */
uint borrowBalance = MToken(mTokenBorrowed).borrowBalanceStored(borrower);
uint maxClose = mul_ScalarTruncate(Exp({mantissa: closeFactorMantissa}), borrowBalance);
if (repayAmount > maxClose) {
return uint(Error.TOO_MUCH_REPAY);
}
​
return uint(Error.NO_ERROR);
}
​

However fixUser() does not take Close Factor into account and fully liquidates the users with bad debt(Users that have a shortfall).

Impact

Close Factor is completely ignored in fixUser() causing all the users with bad debt to get fully liquidated instead of having a part of their debt paid that will bring them in a healthy position and remove their shortfall. This is problematic since this function is intended to be used when it is needed after the upgrade.

Tools Used

Manual review.

Recommendations

Make calls to Comptroller.sol to calculate a users closeFactor to calculate the amount of debt that should be paid and use this in fixUsers() function instead of fully liquidating all users.
closeFactor can be calculated for each user with

uint borrowBalance = MToken(mTokenBorrowed).borrowBalanceStored(borrower);
uint maxClose = mul_ScalarTruncate(Exp({mantissa: closeFactorMantissa}), borrowBalance);
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Other
ljj Submitter
over 1 year ago
0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.