Core Contracts

Summary

Liquidation works on all or nothing basis. If StabilityPool doesn't have enough assets to cover the debt, the liquidation reverts.
The lack of a partial liquidation feature leads to the accumulation of interest on the debt, eventually resulting in bad debt.

Vulnerability Details

Users can deposit RAACNft as colateral in LendingPool and borrow against it. If their health factor becomes unhealthy, the liquidation is started. After grace period expires, onlyManagerOrOwner can call liquidateBorrower.

This function checks if StabilityPool has enough funds to cover the debt and, if not, it reverts.
StabilityPool doesn't implement a partial liquidation function, resulting in an inability to reduce the unhealthy positions size.

Impact

Protocol can't reduce the size of unhealthy positions, leading to the accumulation of more debt than necessary. Over time, this may result in the accumulation of bad debt.

Tools Used

Recommendations

Implement a new function in StabilityPool that allows onlyManagerOrOwner to partially liquidate an unhealthy position. LendingPool::finalizeLiquidation should be updated, or a new similar function to be implemented to reduce a borrower's position by a given amount and transfer only selected NFT/ NFTs to StabilityPool.