Core Contracts

Summary

As part of the LendingPool.sol, if the liquidation has already been initiated, the protocol is paused, and the initial liquidation grace period expires in the meantime, the user can be immediately liquidated once the protocol is unpaused, shortening the initial grace period and reducing the user's chances to repay their debt

Vulnerability Details

Inside the LendingPool contract, users can borrow funds against their collateral. The liquidation process occurs in two steps. First, liquidation is initiated, marking the user's position as liquidatable. However, the user has a three-day grace period to repay their debt and close the liquidation. If the protocol is paused at any time during the grace period, the user will not be able to repay their debt. After the initial grace period has expired (while the protocol is paused), the user will be liquidated immediately once the protocol is unpaused, leaving the user with no chance to repay their debt and shortening their grace period.

NOTE: The current implementation allows liquidation to finalize even if the LendingPool is paused, which is another case. However, assuming that liquidation finalization is not possible when the LendingPool is paused, this scenario will still play out.

POC

Imagine the following scenario:

1. The initial grace period is set to 3 days.

2. The user becomes eligible for liquidation (for whatever reason).

3. 1 day passes.

4. The LendingPool gets paused.

5. 2 additional days pass.

6. The initial grace period (3 days) expires.

7. The protocol gets unpaused.

8. Liquidation is finalized immediately.

The consequence of this scenario is the unfair shortening of the initial grace period from 3 days to 1 day, during which the user had an actual opportunity to repay their debt.)

Impact

Medium - since the repayment window can be unfair for the borrowers if the protocol is paused during the grace period (after the liquidation has been initiated)

Tools Used

VS Code

Recommendations

When unpausing the LendingPool, consider adding additional time (e.g., 1 day) to the initial grace period to ensure fairness and provide users with the opportunity to repay their debts after the contract is unpaused