Submission Details
Severity:
Borrowers are unable to repay debt in pause period
Summary
The function LendingPool::repay() only allows borrowers to repay debt when the contract is unpaused. This can cause debt positions still accrue debt and unable to be repaid.
Vulnerability Details
Both the functions LendingPool::repay() and LendingPool::repayOnBehalf() does not allow borrowers to repay debt in pause period.
function repay(uint256 amount) external nonReentrant whenNotPaused onlyValidAmount(amount) {
_repay(amount, msg.sender);
}
function repayOnBehalf(uint256 amount, address onBehalfOf) external nonReentrant whenNotPaused onlyValidAmount(amount) {
if (!canPaybackDebt) revert PaybackDebtDisabled();
if (onBehalfOf == address(0)) revert AddressCannotBeZero();
_repay(amount, onBehalfOf);
}
PoC
describe("Liquidation", function () {
...
it('unable to repay debt in pause period', async function() {
// @audit PoC unable to repay in pause period
await raacHousePrices.setHousePrice(1, ethers.parseEther("90"));
await lendingPool.connect(user2).initiateLiquidation(user1.address)
await lendingPool.connect(owner).pause();
let totalDebt = await debtToken.balanceOf(user1.address);
await crvusd.mint(user1.address, totalDebt);
await crvusd.connect(user1).approve(lendingPool.target, totalDebt);
// this will fail
await lendingPool.connect(user1).repay(totalDebt);
})
Run the test and console shows:
LendingPool
Liquidation
1) unable to repay debt in pause period
0 passing (2s)
1 failing
1) LendingPool
Liquidation
unable to repay debt in pause period:
Error: VM Exception while processing transaction: reverted with custom error 'EnforcedPause()'
at LendingPool._requireNotPaused (@openzeppelin/contracts/utils/Pausable.sol:83)
at LendingPool.whenNotPaused (@openzeppelin/contracts/utils/Pausable.sol:55)
at LendingPool.repay (contracts/core/pools/LendingPool/LendingPool.sol:401)
Impact
Borrowers can not repay debt in pause period
Positions can be exposed to liquidation if contract is paused
Tools Used
Manual
Recommendations
Remove whenNotPaused for repay functions
Updates
Lead Judging Commences
inallhonesty about 1 month ago
Submission Judgement Published Assigned finding tags:
Unfair Liquidation As Repayment / closeLiquidation Paused While Liquidations Enabled
inallhonesty about 1 month ago
Submission Judgement Published Assigned finding tags:
Unfair Liquidation As Repayment / closeLiquidation Paused While Liquidations Enabled
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.