Core Contracts

Summary

Name: Insufficient Collateral Check in Borrow Function in LendingPoolcontract
Class: Logic Error
Severity: High
Likelihood: Medium
Impact: High

Vulnerability Details

The borrow function incorrectly checks if collateralValue < userTotalDebt.percentMul(liquidationThreshold). This allows users to borrow amounts that exceed their collateral value when liquidationThreshold < 100%, violating the collateralization principle.

Vulnerable Code:

Exploitation Scenarios:

Example 1: Overborrowing Against Collateral

1. Attacker Actions:

   • Deposits an NFT valued at 100 ETH.

   • Borrows 125 crvUSD with liquidationThreshold = 80%.

2. Check Bypass:

   • userTotalDebt = 125 crvUSD.

   • userTotalDebt.percentMul(80%) = 100 crvUSD.

   • collateralValue = 100 ETH → Check passes.

3. Result:

• Debt (125 crvUSD) exceeds collateral (100 ETH).

• Protocol cannot recover debt if NFT value drops.

Example 2: Systemic Risk via Mass Exploitation

1. Attacker Actions:

   • Creates multiple accounts.

   • Each account borrows up to collateralValue / liquidationThreshold.

2. Result:

• Protocol accumulates undercollateralized debt.

• Liquidation fails during market downturns.

POC

Impact

Undercollateralized Debt: Loans exceed collateral value, leading to protocol insolvency.

Liquidation Failures: Collateral cannot cover debt during mass liquidations.

Protocol Instability: Risk of bank run if users lose confidence.

Tools Used

Recommendations

Fix the Collateral Check:

Replace the flawed condition with:

Formula:

​

Example: For liquidationThreshold = 80%, collateral must be ≥ 125% of debt.

Add Documentation: Clarify that liquidationThreshold represents the minimum collateral-to-debt ratio.