Part 2

The function getTotalCreditCapacityUsd() calculates a vault’s total credit capacity in USD terms but fails to properly account for all outstanding debt. It computes credit capacity as:

However, getTotalDebt(self) does not properly include all unsettled debt components, particularly certain forms of unrealized debt or debts that have not yet been distributed through _recalculateConnectedMarketsState(). This creates an incorrectly inflated credit capacity, leading to over-delegation of credit and potential insolvency when real debt is eventually realized.

To be more detailed on whats going on here:

The function getTotalCreditCapacityUsd() determines a vault’s available credit by subtracting its total debt from its asset value. However, the function relies on getTotalDebt(self), which does not account for all forms of unsettled or pending debt, particularly those still being distributed through _recalculateConnectedMarketsState(). This means that when a vault queries its credit capacity, it may see an inflated value that does not reflect the full extent of its outstanding liabilities. To add, the vault might over-delegate credit, assuming it has more available than it truly does. If unaccounted debts later materialize such as when markets finalize debt distributions the vault could suddenly find itself over-leveraged and under-collateralized, leading to forced liquidations or insolvency risks.

Impact:

Vaults may allocate more credit than they can actually cover, leading to over-leverage and potential insolvency when unaccounted debt is realized.

Mitigation:

Ensure getTotalDebt(self) includes all unsettled debt components by explicitly incorporating pending debt updates from _recalculateConnectedMarketsState() before calculating credit capacity.