DeFiFoundry
60,000 USDC
View results
Submission Details
Severity: high
Invalid

Healthy accounts can be liquidated unfairly, leading to a loss of funds to the user.

Summary

Healthy accounts can be liquidated unfairly, leading to a loss of funds to the user.

Vulnerability Details

The function's logic aims to prevent a scenario where a batch of liquidations revert because one of the accounts in the liquidation batch was healthy. However, this can lead to a situation where a healthy account is liquidated unfairly. If the account's position is healthy, and the contract continues execution without reverting , the healthy account's position will be liquidated.
LiquidationBranch.sol#L146-#L148

// if account is not liquidatable, skip to next account
// account is liquidatable if requiredMaintenanceMarginUsdX18 > ctx.marginBalanceUsdX18
// @audit healthy accounts can be liquidated unfairly.
if (!TradingAccount.isLiquidatable(requiredMaintenanceMarginUsdX18, ctx.marginBalanceUsdX18)) {
continue;
}

Proof of Concept

  • Assume there is one account in the liquidator list in the array of accounts to be liquidated.

  • The account is healthy so TradingAccount.isLiquidatable(requiredMaintenanceMarginUsdX18, ctx.marginBalanceUsdX18) is false.

  • The function continues execution instead of reverting and the healthy account's position gets liquidated.

if (!TradingAccount.isLiquidatable(requiredMaintenanceMarginUsdX18, ctx.marginBalanceUsdX18)) {
continue;
}


Impact

Healthy accounts can be liquidated unfairly, leading to a loss of funds to the user.

Tools Used

Manual Review

Recommendations

The protocol should do a returnn if the account to liquidate is healthy.

if (!TradingAccount.isLiquidatable(requiredMaintenanceMarginUsdX18, ctx.marginBalanceUsdX18)) {
+ return;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.