Core Contracts

Summary

if a user debt position’s healthFactor is below healthFactorLiquidationThreshold, then anyone can initiate liquidation for this debt position. Borrower can close the liquidation for his debt position by calling the function closeLiquidation before ending liquidationGracePeriod. But debt is not paid in the function closeLiquidation, also now function finalizeLiquidation can’t be called for this debt position address because isUnderLiquidation[userAddress] = false for this debt position. As a result, user’s debt position can't be liquidated even if their position’s healthFactor is below healthFactorLiquidationThreshold. So anyone initiates liquidation for their position, before liquidationGracePeriod ending , they will close their liquidation without paying debt and now function finalizeLiquidation can’t be called for this debt position to liquidate their position even those position’s healthFactor is below healthFactorLiquidationThreshold.

Vulnerability Details

1. Let’s assume, alice has a debt position in the lendingpool and alice’s debt position healthFactor is below healthFactorLiquidationThreshold. Now function initiateLiquidation is called for alice debt position address, so isUnderLiquidation is true for alice debt position i.e isUnderLiquidation[userAddress] = true;

2. before liquidationGracePeriod ending, alice calls the function closeLiquidation() and so now isUnderLiquidation is false for alice debt position i.e isUnderLiquidation[userAddress] = false. If you see the function closeLiquidation() where userDebt is not paid by borrowers.

3. so Alice makes her debt position’s isUnderLiquidation[userAddress] = false without paying debts by calling the function closeLiquidation().

4. afterthat, function finalizeLiquidation is called for alice’s debt position by stabilityPool. But Alice's debt position will not be liquidated as currently isUnderLiquidation[userAddress] = false for her debt position.

5. As a result, any user/alice’s debt position will not be liquidated even their position’s healthFactor is below healthFactorLiquidationThreshold

Impact

the function finalizeLiquidation can’t be called for those debt positions to liquidate their position even if those positions's healthFactor is below healthFactorLiquidationThreshold.

Tools Used

manual review

Recommendations

make sure borrowers repay their debt when calling the function closeLiquidation.