Core Contracts

Bug description

When a user tries to borrow assets from the lending pool, the borrow() function checks if a user has enough collateral.

LendingPool.sol#L344-L346

However, the check used is incorrect. It applies the liquidation threshold to debt instead of collateral. The liquidation threshold determines the maximum percentage of value that can be borrowed against an asset; therefore, it should be applied to collateral instead.

Consider a scenario where the collateral asset and asset supplied by the lender have a 1:1 exchange rate, the liquidation threshold is set to 80% and the user has provided 1000 collateral assets. Therefore he should be able to borrow 1000 * 80% = 800 assets at most. However with the current check If the user attempts to borrow 1250 assets, the check would evaluate as 1000 < 1250 * 0.8 = false, because 1250 * 0.8 = 1000. Because of that by supplying 1000 assets of collateral, the user can borrow 1250 assets and never repay his loan as he just profited by 250 assets.

The same issue is present in withdrawNFT(), where the user can withdraw an NFT leaving himself undercollateralized.

LendingPool.sol#L302-L304

The issue becomes even more evident if we look at the calculateHealthFactor() function.

LendingPool.sol#L545-L554

As we can see, the liquidation threshold is applied to collateral instead of debt.

Impact

Users can steal assets by borrowing more than supplied collateral and never repaying their loans.

Proof of Concept

Please add this test to LendingPool.test.js and run it with npx hardhat test --grep "allows borrowing more than it should".

Recommended Mitigation

When determining health of the borrower's position, either multiply collateral value by the liquidation threshold or divide debt by the same liquidation threshold.