Submission Details
Severity:
If LTV of asset is changed, liquidation priority should be updated
Summary
When an asset's LTV changes, the liquidation priority must be reordered to use the more volatile collateral first.
Vulnerability Details
When configureMarginCollateral() is called, the ltv of an asset can be changed, but this does not change the liquidation priority, which in this case will be ordered incorrectly.
function configureMarginCollateral(
address collateralType,
uint128 depositCap,
uint120 loanToValue,
address priceFeed,
uint32 priceFeedHeartbeatSeconds
)
external
onlyOwner
{
try ERC20(collateralType).decimals() returns (uint8 decimals) {
if (decimals > Constants.SYSTEM_DECIMALS || priceFeed == address(0) || decimals == 0) {
revert Errors.InvalidMarginCollateralConfiguration(collateralType, decimals, priceFeed);
}
MarginCollateralConfiguration.configure(
collateralType, depositCap, loanToValue, decimals, priceFeed, priceFeedHeartbeatSeconds
);
emit LogConfigureMarginCollateral(
msg.sender, collateralType, depositCap, loanToValue, decimals, priceFeed, priceFeedHeartbeatSeconds
);
} catch {
revert Errors.InvalidMarginCollateralConfiguration(collateralType, 0, priceFeed);
}
}
Impact
Wrong liquidation priority if asset's ltv changes.
Tools Used
Manual Review
Recommendations
When configureMarginCollateral is called, the code should remove all assets from the liquidation priority and call configureCollateralLiquidationPriority again with assets sorted based on loan-to-value.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,87821 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.