Core Contracts

Summary

The LendingPool contract implements a restrictive liquidation mechanism where only the Stability Pool contract can execute liquidations. This design choice deviates from industry standards and could lead to inefficiencies in the liquidation process.

Vulnerability Details

The liquidation process is controlled through the onlyStabilityPool modifier in the finalizeLiquidation() function:

This creates a centralized point of control where only one entity can perform liquidations, contrary to traditional DeFi lending platforms like Aave or Compound where liquidations are permissionless and can be executed by any external party.

Impact

• The RAAC Team needs to monitor all Borrow activities to handle liquidations in time

• Single point of failure through Stability Pool

• Increased risk during high market volatility

• Potential for delayed liquidations if Stability Pool is congested

Tools Used

• Manual Review

Recommendations

Implement a permissionless liquidation mechanism + an incentive to call the liquidate function.