Core Contracts

Summary

The LendingPool contract's borrow function lacks proper sequencing of validation checks. The collateral verification occurs after state changes, creating a race condition where users can borrow without adequate backing. A user without any collateral can successfully call borrow() despite the protocol's requirement for collateralized loans.

Vulnerability Details

The LendingPool's borrow function contains validation checks that should prevent borrowing when:

The collateral validation is implemented as an if-statement that reverts, this check can be bypassed in certain states. The validation occurs after state changes, allowing the malicious attacker to manipulate the execution flow between the collateral check and actual borrowing. When a user requests a loan, the contract should verify their collateral value before allowing any borrowing. However, the current implementation performs these checks after critical state changes.

Root Cause

The LendingPool contract performs collateral validation after critical state changes, creating a window where the validation can be bypassed. The proper sequence should validate all requirements before any state modifications.

Attack Flow

A malicious user could:

1. Call borrow() with a non-zero amount

2. The contract checks isUnderLiquidation status

3. Retrieves user's collateral value

4. Due to improper validation ordering, the borrowing succeeds despite zero collateral

Impact

This enables undercollateralized borrowing, directly threatening the protocol's solvency and potentially leading to bad debt accumulation in the lending pool.

includes:

1. Protocol insolvency risk as loans lack proper backing

2. Manipulation of lending pool reserves

3. Destabilization of the protocol's economic model

Recommendations

Implement strict validation ordering