Zaros Part 1

Summary

Liquidators can be not interested in liquidation of small debts. So this debts will remain in the protocol and will create bad debt.

Vulnerability Details

In order to liquidate a position, Zaros currently has trusted liquidators that can do this via the liquidateAccounts function.

Naturally, this will be only done, when liquidation is attractive to liquidator, which means that he will earn something from the call.

Now there are some fees that could go to the liquidator

But in case if the debt is too small(for example < 5$), that means that it would not be attractive for the liquidator to liquidate debt, because he will spend more funds as gas payment asides the time that would be invested in a quite minute profit point. Which means that such debts usually will not be liquidated and will remain in the system and create bad debt (from subsequent similar situations).

Impact

Protocol's overall collateral/stability on loans given out is at risk here, considering the scenario explained above is only one position, imagine multiple users with malicious intents all do the same having somewhat dust positions, this leaves the protocol with multiple bad debts that no one would want to liquidate, potentially breaking the protocol's solvency.

Tools Used

• Manual review

• Past findings:

  • https://github.com/code-423n4/2024-04-dyad-findings/issues/175

  • https://www.codehawks.com/report/clql6lvyu0001mnje1xpqcuvl#M-04

  • https://solodit.xyz/issues/m-4-attackers-can-create-positions-that-have-no-incentive-to-be-liquidated-sherlock-perpetual-git

  • https://solodit.xyz/issues/m-05-the-protocol-allows-borrowing-small-positions-that-can-create-bad-debt-code4rena-wise-lending-wise-lending-git

  • https://solodit.xyz/issues/m-22-minimium-collateral-check-can-be-bypassed-code4rena-saltyio-saltyio-git

Recommendations

Consider having a minimum restriction on the amount of collateral that can be provided before giving out a loan.