Summary
The protocol allows an owner or governance entity to modify the LendingPool::liquidationGracePeriod using the LendingPool::setParameter function. This creates a vulnerability where a user repaying their debt during the original grace period might be locked out of the protocol if the grace period is shortened before they call closeLiquidation().
Vulnerability Details
Initiate Liquidation:
When a user's health factor falls below the healthFactorLiquidationThreshold, initiateLiquidation() is called.
The function sets isUnderLiquidation[userAddress] = true and records liquidationStartTime[userAddress] = block.timestamp.
LendingPool::initiateLiquidation:
function initiateLiquidation(address userAddress) external nonReentrant whenNotPaused {
if (isUnderLiquidation[userAddress]) revert UserAlreadyUnderLiquidation();
ReserveLibrary.updateReserveState(reserve, rateData);
UserData storage user = userData[userAddress];
uint256 healthFactor = calculateHealthFactor(userAddress);
@> if (healthFactor >= healthFactorLiquidationThreshold) revert HealthFactorTooLow();
@> isUnderLiquidation[userAddress] = true;
@> liquidationStartTime[userAddress] = block.timestamp;
emit LiquidationInitiated(msg.sender, userAddress);
}
2.Repayment During Grace Period:
The user repays their entire debt by calling repay(amount), which reduces user.scaledDebtBalance to zero.
However, isUnderLiquidation[userAddress] remains true until closeLiquidation() is called.
LendingPool::repay:
function repay(uint256 amount) external nonReentrant whenNotPaused onlyValidAmount(amount) {
_repay(amount, msg.sender);
}
function _repay(uint256 amount, address onBehalfOf) internal {
if (amount == 0) revert InvalidAmount();
if (onBehalfOf == address(0)) revert AddressCannotBeZero();
UserData storage user = userData[onBehalfOf];
ReserveLibrary.updateReserveState(reserve, rateData);
uint256 userDebt = IDebtToken(reserve.reserveDebtTokenAddress).balanceOf(onBehalfOf);
uint256 userScaledDebt = userDebt.rayDiv(reserve.usageIndex);
uint256 actualRepayAmount = amount > userScaledDebt ? userScaledDebt : amount;
uint256 scaledAmount = actualRepayAmount.rayDiv(reserve.usageIndex);
(uint256 amountScaled, uint256 newTotalSupply, uint256 amountBurned, uint256 balanceIncrease) =
@> IDebtToken(reserve.reserveDebtTokenAddress).burn(onBehalfOf, amount, reserve.usageIndex);
@> IERC20(reserve.reserveAssetAddress).safeTransferFrom(msg.sender, reserve.reserveRTokenAddress, amountScaled);
reserve.totalUsage = newTotalSupply;
@> user.scaledDebtBalance -= amountBurned;
ReserveLibrary.updateInterestRatesAndLiquidity(reserve, rateData, amountScaled, 0);
emit Repay(msg.sender, onBehalfOf, actualRepayAmount);
}
3.Owner or Through Governance Reduces Grace Period:
Before the user can call closeLiquidation(), the owner or governance shortens the liquidationGracePeriod using setParameter(OwnerParameter.LiquidationGracePeriod, newValue).
This causes block.timestamp > liquidationStartTime[userAddress] + liquidationGracePeriod to evaluate as true, blocking closeLiquidation()
LendingPool::setParameter:
function setParameter(OwnerParameter param, uint256 newValue) external override onlyOwner {
if (param == OwnerParameter.LiquidationThreshold) {
require(newValue <= 100_00, "Invalid liquidation threshold");
liquidationThreshold = newValue;
emit LiquidationParametersUpdated(liquidationThreshold, healthFactorLiquidationThreshold, liquidationGracePeriod);
}
else if (param == OwnerParameter.HealthFactorLiquidationThreshold) {
healthFactorLiquidationThreshold = newValue;
emit LiquidationParametersUpdated(liquidationThreshold, healthFactorLiquidationThreshold, liquidationGracePeriod);
}
@> else if (param == OwnerParameter.LiquidationGracePeriod) {
@> require(newValue >= 1 days && newValue <= 7 days, "Invalid grace period");
@> liquidationGracePeriod = newValue;
@> emit LiquidationParametersUpdated(liquidationThreshold, healthFactorLiquidationThreshold, liquidationGracePeriod);
@> } ........
LendingPool::closeLiquidation:
function closeLiquidation() external nonReentrant whenNotPaused {
address userAddress = msg.sender;
if (!isUnderLiquidation[userAddress]) revert NotUnderLiquidation();
ReserveLibrary.updateReserveState(reserve, rateData);
@> if (block.timestamp > liquidationStartTime[userAddress] + liquidationGracePeriod) {
@> revert GracePeriodExpired();
@> }
UserData storage user = userData[userAddress];
uint256 userDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex);
if (userDebt > DUST_THRESHOLD) revert DebtNotZero();
isUnderLiquidation[userAddress] = false;
liquidationStartTime[userAddress] = 0;
emit LiquidationClosed(userAddress);
}
4.User Is Permanently Blocked:
Since isUnderLiquidation[userAddress] is never reset, the user cannot borrow, participate in lending, or perform other protocol functions.
The protocol incorrectly treats them as if they still have debt, even though they fully repaid.
Impact
Users are permanently locked out of the protocol despite having repaid their debt in time.
Denial of Service for users because they would not be able to even withdraw his nft back as the parameter is not reset nor would be able to perform any borrorw operations.
LendingPool::withdrawNFT:
function withdrawNFT(uint256 tokenId) external nonReentrant whenNotPaused {
@> if (isUnderLiquidation[msg.sender]) revert CannotWithdrawUnderLiquidation();
UserData storage user = userData[msg.sender];
if (!user.depositedNFTs[tokenId]) revert NFTNotDeposited();.........
LendingPool::borrow:
function borrow(uint256 amount) external nonReentrant whenNotPaused onlyValidAmount(amount) {
@> if (isUnderLiquidation[msg.sender]) revert CannotBorrowUnderLiquidation();
UserData storage user = userData[msg.sender];
uint256 collateralValue = getUserCollateralValue(msg.sender);......
Funds at Risk: If the user's NFT collateral is still held, they may be unable to reclaim it despite clearing their debt.
Tools Used
Manual
Recommendations
Modify repay() to automatically reset isUnderLiquidation[userAddress] if user.scaledDebtBalance == 0 instead of requiring a separate closeLiquidation() call.
Prevent reducing liquidationGracePeriod for users who are already in liquidation, ensuring they receive the originally set grace period.
