First Flight #21: KittyFi

Summary

There is no guarantee that the vault has enough assets to cover for extraReward during liquidation.

Vulnerability Details

The code on lines 147-149 indicates that the liquidator potentially receives extraReward payable by a vault they liquidate a position from. However, in a worst-case situation where the asset price drops significantly, the vault may not have excess assets to cover for the extraReward and therefore the liquidation process will fail.

Impact

Failing liquidation process.

Tools Used

Manual review.

Recommendations

Consider checking the existing assets before distributing extraReward.