Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Borrowers can't `closeLiquidation` if liquidation grace period expired; Borrower can still be liquidated, even if their debt is fully repaid

alexczm

Summary

The liquidationGracePeriod check in LendingPool::closeLiquidation can lead to borrower still be liquidated even if his debt is fully repaid.

Vulnerability Details

Liquidation process in LendingPool consists in 2 steps: initiateLiquidation where a liquidationStartTime counter is started and, after liquidationGracePeriod has expired, finalizeLiquidation can be called to settle the liquidation.
The borrower who is under liquidation can repay his debt and close the liquidation process by calling closeLiquidation

// LendingPool.sol
​
function closeLiquidation() external nonReentrant whenNotPaused {
address userAddress = msg.sender;
​
if (!isUnderLiquidation[userAddress]) revert NotUnderLiquidation();
​
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
@> if (block.timestamp > liquidationStartTime[userAddress] + liquidationGracePeriod) {
revert GracePeriodExpired();
}
​
UserData storage user = userData[userAddress];
​
uint256 userDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex);
​
if (userDebt > DUST_THRESHOLD) revert DebtNotZero();
​
isUnderLiquidation[userAddress] = false;
liquidationStartTime[userAddress] = 0;
​
emit LiquidationClosed(userAddress);
}

There is a problem not allowing a borrower to close the liquidation after liquidationGracePeriod has passed.
Consider the following example:

  • Alice deposit her RAACNft and borrow against it.

  • her collateral value drops and liquidation process is started;

  • liquidationGracePeriod has passed

  • Alice fully repay her debt or her friend Bob repayOnBehalf of Alice. None of these functions are gated by a non-expired grace period. Debt can be rapid at any time;

  • Alice calls closeLiquidation and the transaction reverts due to expired grace period.

  • finalizeLiquidation and Alice is liquidated even if she fully repaid her debt.

Impact

Borrowers can be liquidated unfairly.

Tools Used

Recommendations

Remove liquidationGracePeriod check from closeLiquidation to allow borrowers to close the liquidation when the debt is repaid. At most request a late close liquidation fee payment,

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

A borrower can LendingPool::repay to avoid liquidation but might not be able to call LendingPool::closeLiquidation successfully due to grace period check, loses both funds and collateral

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.