Summary

Vulnerability Details

During liquidation process in the fixUser() function, the user's remaining balance is transferred to the liquidator and the user's debt is set to zero. The contract then proceeds to increment the badDebt variable by the full amount of the user's initial principal debt. badDebt = SafeMath.add(badDebt, principal);. However, this calculation fails to account for the economic value recovered through the seizure of the user's collateral. As a result, the increase in badDebt does not accurately reflect the net loss to the system post-liquidation.

Impact

The inflated bad debt value paints an inaccurate picture of the protocol's financial situation. This can mislead stakeholders and users about the true extent of the outstanding debt.

Tools Used

Manual Review

Recommendations

Modify the bad debt calculation to factor in the value of the collateral liquidated during the process. This can be achieved by only incrementing the badDebt by the difference between the principal and the value of the liquidated collateral.