Summary

`activePositionsLength is 0` this means there are no active positions managed by the contract, which implies there should be no liquidatable accounts.

Bounds given are lowerBound = 2 and upperBound = 3, which are clearly out of the range of existing active accounts (since there are none).

Vulnerability Details

the function returns an array of length 1. This indicates:

The function might be initializing the array `liquidatableAccountsIds` with the size directly derived from the difference between upperBound and lowerBound (which equals 1 in this case) without validating whether there are actual data entries within these bounds to justify this size.

Impact

The protocol act on the output of this function, it could potentially lead to incorrect liquidations.

For instance, if the system attempts to liquidate what it believes to be a valid account based on the returned array, it might either fail (due to the non-existence of the account) or incorrectly affect other state variables or balances within the contract.

Tools Used

manual review

Recommendations