Core Contracts

01. Relevant GitHub Links

• LendingPool.sol#L484

02. Summary

The LendingPool contract allows any stablecoin to serve as the reserveAssetToken (e.g., tokens with 6 or 18 decimals). However, the contract uses a fixed DUST_THRESHOLD of 1e6 in closeLiquidation. This fixed value can cause unintended behavior when stablecoins with decimals other than 18 are used, potentially triggering liquidation closure prematurely for users borrowing large amounts.

Additionally, the system assumes that the debtToken and rToken will always have 18 decimals, even if the underlying reserveAssetToken has a different decimal configuration. This mismatch can lead to precision loss when the reserveAssetToken has decimals larger than 18, creating unexpected edge cases.

03. Vulnerability Details

• Fixed Threshold: DUST_THRESHOLD is hard-coded to 1e6. When the reserveAssetToken has 6 decimals, 1e6 may be too big relative to the total borrow, allowing liquidation to close early.

• Decimal Mismatch: The protocol enforces 18 decimals for debtToken and rToken, but the actual reserveAssetToken might not be 18 decimals. If it is larger, significant precision loss can occur, introducing further risk of inaccurate debt or collateral calculations.

04. Impact

• Borrowers using stablecoins with a non-18 decimal value are at risk of having their accounts incorrectly liquidated or closed because the threshold no longer matches the actual token precision. Or they may be closed prematurely.

• Incorrect handling of decimals may cause sudden liquidation closings or inaccurate debt tracking, undermining the protocol’s reliability.

05. Tools Used

Manual Code Review and Foundry

06. Recommended Mitigation

• Dynamically set DUST_THRESHOLD based on the reserveAssetToken’s decimals.

• Ensure all tokens, including debtToken and rToken, consistently handle various decimals, or enforce a single decimal format across the system to avoid precision loss.

• Include checks during deployment or configuration so that any chosen reserveAssetToken meets required decimal constraints or triggers an appropriate adjustment for the threshold.