Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Debt Calculation Due to Double Normalization in `StabilityPool::liquidateBorrower` Function

zgczgc

Summary

The liquidateBorrower function in the StabilityPool contract incorrectly calculates the user's debt by applying normalization twice, potentially leading to inflated debt values and failed liquidations.

Vulnerability Details

function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
_update();
uint256 userDebt = lendingPool.getUserDebt(userAddress); // @audit already normalized
uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt()); <==@found
if (userDebt == 0) revert InvalidAmount();
uint256 crvUSDBalance = crvUSDToken.balanceOf(address(this));
if (crvUSDBalance < scaledUserDebt) revert InsufficientBalance();
bool approveSuccess = crvUSDToken.approve(address(lendingPool), scaledUserDebt);
if (!approveSuccess) revert ApprovalFailed();
lendingPool.updateState();
lendingPool.finalizeLiquidation(userAddress);
emit BorrowerLiquidated(userAddress, scaledUserDebt);
}

Impact

  • Inflated Debt Values:
    Debt amounts are incorrectly multiplied by the normalization factor
    Users may be over-liquidated
    Protocol may attempt to liquidate more than the actual debt

  • Failed Liquidations:
    Liquidations may fail due to insufficient balance checks
    Protocol's stability mechanism is compromised
    Potential blocking of legitimate liquidations
    Incorrect Event Emissions:
    Events record wrong liquidation amounts
    Affects off-chain monitoring and analytics
    Historical data becomes unreliable

Tools Used

  • Manual Review

Recommendations

Remove the second normalization and use the debt value directly from getUserDebt()

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::liquidateBorrower double-scales debt by multiplying already-scaled userDebt with usage index again, causing liquidations to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.