Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`StabilityPool::liquidateBorrower` is scaling twice an already scaled value

infect3d

Summary

The liquidateBorrower() function read the userDebt from getUserDebt(), which returns the scaled debt balance of the user.
But right after, it scales it again, resulting in an incorrect value/

Vulnerability details

Here's the implementation of getUserDebt(), as we can see, the userDebt is multiplied by the index and that value is returned:

File: contracts/core/pools/LendingPool/LendingPool.sol
579: function getUserDebt(address userAddress) public view returns (uint256) {
580: UserData storage user = userData[userAddress];
581: return user.scaledDebtBalance.rayMul(reserve.usageIndex);
582: }
583:

But right after, the userDebt is again scaled with the index:

File: contracts/core/pools/StabilityPool/StabilityPool.sol
449: function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
450: _update();
451: // Get the user's debt from the LendingPool.
452: uint256 userDebt = lendingPool.getUserDebt(userAddress);
453: uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt());
454:

Impact

Wrong debt value computed

Recommended Mitigation Steps

function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
_update();
// Get the user's debt from the LendingPool.
- uint256 userDebt = lendingPool.getUserDebt(userAddress);
+ uint256 scaledUserDebt = lendingPool.getUserDebt(userAddress);
- uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt());
- if (userDebt == 0) revert InvalidAmount();
+ if (scaledUserDebt == 0) revert InvalidAmount();
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::liquidateBorrower double-scales debt by multiplying already-scaled userDebt with usage index again, causing liquidations to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.