Core Contracts

Summary

invalid calculation happen inside liquidateBorrowerfunction where it calculate userDebtusing unupdated index, potentially make the function revert if the amount is less than the actual userDebtmultiplied by the updated index because insufficient balance.

Vulnerability Details

the vulnerability lies inside the liquidateBorrower:

StabilityPool.sol#L449-L470

when the function first calculate userDebt, it fetch the value of normalized debt amount (scaled x interest).

there are few issue here, first the return value of getUserDebtis already multiplied by interest index but on the next line the userDebtis getting multiplied by the same index.

second, the approve function are called using the amount of scaledUserDebtfrom previous step, which is innacurrate.

why? because it calculated before lendingPool.updateState()is called. this is crucial because the updateStatefunction would later update the index of debt interest and also the index of income interest.

so on the first step, the index used to calculate the user debt are using the old value instead of the new one.

Impact

the function would revert when the approved amount of scaledUserDebtare not sufficient when it would be transferred later in lendingPool.finalizeLiquidationfunction. because inside of finalizeLiquidation, the actual amount transferred from the StabilityPool would be calculated using updated index.

Tools Used

manual review

Recommendations

first update the index by calling lendingPool.updateState()before calculating the borrower debt.

second, no need to multiply the user debt amount if you want to get the scaled amount. instead you should divide it.