Core Contracts

Summary

Incorrect debt calculation in liquidateBorrower

Vulnerability Details

When the borrower's position is unhealthy, the owner or managers can liquidate this borrower via liquidateBorrower() function. In liquidateBorrower(), we will get the borrower's debt from lendingPool.getUserDebt(userAddress). When we check the implementation of getUserDebt() function, the getUserDebt() return value is the borrower's actual debt amount.

The problem here is that we multiple another lendingPool.getNormalizedDebt(), this will cause that scaledUserDebt will be larger than the borrower's actual debt amount. And based on if (crvUSDBalance < scaledUserDebt) revert InsufficientBalance();, the owner has to transfer more crvUSD tokens than expected into the stabilityPool before the owner wants to liquidate this borrower.

When we check finalizeLiquidation() function, the lending pool will calculate the correct borrower's debt and transfer the correct crvUSD token from the stabilitiyPool.

The problem is that the owner has to transfer more crvUSD into the stability pool before we liquidate one position. And the most important thing here is that we do not have one interface in stabilityPool to transfer crvUSD token out. This will cause some crvUSD tokens locked in stabilityPool.

Impact

Some crvUSD tokens will be locked in stabilityPool.

Tools Used

Manual

Recommendations

Calculate the correct borrower' debt in liquidateBorrower(), then the owner will not need to transfer more crvUSD token to liquidate borrowers' positions.