Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Double Application of `usageIndex` in `StabilityPool.liquidateBorrower`

newspacexyz

Summary

A critical issue was found in the liquidateBorrower function in StabilityPool.sol. The function calculates scaledUserDebt using:

scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt());

However, userDebt is already multiplied by reserve.usageIndex, so applying getNormalizedDebt() again results in double application of usageIndex. This causes incorrect debt calculations during liquidation.

Vulnerability Details

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/StabilityPool/StabilityPool.sol#L449

function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
_update();
// Get the user's debt from the LendingPool.
@>> uint256 userDebt = lendingPool.getUserDebt(userAddress);
@>> uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt());
...
}

  • The function retrieves userDebt, which is already scaled by usageIndex.

  • It then multiplies userDebt again by lendingPool.getNormalizedDebt(), which is actually the same usageIndex.

  • This results in an inflated value for scaledUserDebt, leading to overestimation of the borrower’s debt.

Impact

  • Borrowers could be liquidated unfairly due to their debt appearing higher than it actually is.

  • Borrowers could lose their collateral unfairly due to overestimating the required liquidation repayment.

Tools Used

Manual code review

Recommendations

It should be:

scaledUserDebt = userDebt;
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::liquidateBorrower double-scales debt by multiplying already-scaled userDebt with usage index again, causing liquidations to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.