Core Contracts

Summary

LendingPool::repay has whenNotPaused modifier. If a borrower is in liquidation state and contract is paused, he may be unable to repay and closeLiquidation on time. Borrower gets liquidated unfairly.

Vulnerability Details

Borrowers can borrow from LendingPool using their RAACNFTs as collateral and to repay it by calling repay.

Pool has a liquidation mechanism consisting of 2 parts: initiateLiquidations and after the liquidationGracePeriod expires, finalizeLiquidation is called.
liquidationGracePeriod can have a value between 1 and 7 days.

The problem is if liquidation has started a borrower is unable to repay debt and avoid liquidation when contract is paused.
Consider following scenario:

• borrower Alice deposit a NFT worth 100_000 and borrow 75_000;

• after some time her NFT collateral value drops to 70_000 and liquidation is started;

• before liquidationGracePeriod expires, owner pause the contract;

• when Alice wants to repay her debt, tx reverts due to whenNotPaused modifier; Alice will get liquidated

Impact

Borrowers are unable to repay debt;
Protocol may accumulate bad debt if liquidated debt value is bigger than NFT collateral.

Tools Used

Recommendations

Allow borrowers to repay their debt and remove whenNotPaused modifier from LendingPool::repay and LendingPool::repayOnBehalf