Zaros Part 1

Summary

checkLiquidatableAccounts returns incomplete list of accounts for liqudations from provided bounds.

Vulnerability Details

The checkLiquidatableAccounts function is used to retrieve a list of accounts that should be liquidated. It receives two parameters lowerBound and upperBound, so it should return accounts from the given range. But because of the condition in the for loop

it omits element in the last position ( accountsIds[upperBound] ).

Zaros implemented very similar method named "getAccountsWithActivePositions" (GlobalConfigurationBranch), where they calculate it correctly

Note the difference in comparison operator < vs <= (They also define different array size)

Impact

Protocol use this function to get a list of accounts to be liquidated. Omitting such an account means that the collateral will not be sufficient to cover the losses, resulting in protocol losses

Tools Used

Manual review

Recommendations

Use similar implementation as in getAccountsWithActivePositions