User can be liquidated even after repaying the loan
Likelihood
Medium
Impact
High
Description
->After the Initialization of liquidation, the NFT owner is given a grace period in which they can repay the loan and get their collateralized NFT back to them. However there is problem, Whenever a user is under Liquidation, Even after paying back the Loan, the user can be Liquidated, Because when Repaying and closing the loan, the closeLiqudation() is not called and the liquidation can still happen.
Consider the Scenario
-> Bob is user who has a NFT as collateral for a borrow he had made
-> Bob sees that his position has been initiated to be liquidated
-> He rushes to repay his debt by the calling repay().
-> Even after Repaying, his liquidation hasn't stopped.
-> After time has passed (block.timstamp > liquidationTIme + GracePeriod) CloseLiquidation would not be callable any more.
Summary
WHEN IT WILL HAPPEN => When the user forget to call the second function (closeLiquidation() ) even after paying back
What will happen => User will be liquidated even after paying back the loan
Mitigation
Adding the check if, userDebt =0 and if the user is under liquidation and the time is still under grace period then calling
closeLiquidation()
Lead Judging Commences
A borrower can LendingPool::repay to avoid liquidation but might not be able to call LendingPool::closeLiquidation successfully due to grace period check, loses both funds and collateral
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.