Core Contracts

Vulnerability Details

In the borrow function of the LendingPool contract, the collateral check contains an off-by-one error in its inequality comparison. The current implementation uses a strict less-than (<) comparison when verifying if the collateral value meets the liquidation threshold requirement.

This allows a scenario where:

collateralValue == userTotalDebt.percentMul(liquidationThreshold)

to pass the check and enable borrowing, even though this represents the exact liquidation threshold where the position should be considered unsafe.

Impact

1. Allows creation of immediately liquidatable positions

2. Users can borrow up to the absolute maximum without safety margin

3. Puts protocol funds at risk if asset prices decrease even slightly

4. Violates core protocol safety mechanisms designed to maintain over-collateralization

Recommendations

Modify the inequality check to use less-than-or-equal-to: