[H-03] KittyPool::purrgeBadPawsion Should Not Call KittyVault::executeWhiskdrawal But Directly Transfer Collaterals

Summary

The purrgeBadPawsion function in the KittyPool contract is designed to incentivize liquidators by calling the executeWhiskdrawal function on each vault involved in the liquidation process. However, this approach inadvertently reduces the liquidator's own collateral instead of incentivizing them, as executeWhiskdrawal operates on the assumption that the liquidator is withdrawing their own funds. This misalignment leads to two primary issues:

1. In the best-case scenario, the function will always revert due to the liquidator not having deposited any collateral with the protocol.

2. In the worst-case scenario, the liquidator loses money instead of gaining a reward, as they pay the kitty coins for liquidating and receive their own deposited collateral instead of a reward.

Vulnerability Details

The core issue arises from the purrgeBadPawsion function calling _vault.executeWhiskdrawal(msg.sender, toDistribute + extraReward); with msg.sender as the user input, which incorrectly treats the liquidator as withdrawing their own collateral, thereby reducing their share instead of increasing it as a reward.

The executeWhiskdrawal function is designed to allow users to withdraw their collateral, but when called with the intention of rewarding a liquidator, it fails to serve its intended purpose.

Impact

This flaw directly impacts the financial outcome for liquidators, who are supposed to be rewarded for their actions but end up losing money instead.

Tools Used

Manual Review

Recommendations

To address this issue, a separate function specifically designed for liquidation rewards should be created. This new function would correctly increase the liquidator's share in the vaults, ensuring that they are genuinely incentivized for their role in the liquidation process.