Summary

When configureCollateralLiquidationPriority() is called, it does not ensure that the passed assets are with loan-to-value in ascending order.

Vulnerability Details

Assets in liquidation priority should be ordered by loan-to-value parameter, starting with the smallest. But this is not the case as there is no check for this when adding them.

Impact

Wrong asset order will result in the wrong tokens being sent when the position is liquidated.

Tools Used

Manual Review

Recommendations

When configureCollateralLiquidationPriority() is called, there should be a check to see if the ltv of a collateral from GlobalConfigurationBranch is less than the next one in the collateralTypes array, if not first sort them and then configure them.