Core Contracts

Summary

A borrower can transfer their debt tokens to the zero address (0x0), effectively burning them. Since liquidations rely on burning the borrower's debt token balance, this action prevents liquidation from properly executing. This allows a borrower to avoid liquidation indefinitely, potentially leading to bad debt accumulation.

Impact

This vulnerability allows borrowers to permanently escape liquidation, leading to protocol insolvency. Liquidations depend on burning user debt tokens, so when a user transfers debt tokens to 0x0 address and burn them, liquidators cannot execute liquidations successfully because user has not enough debt token balance to be burned.

• Loss of solvency: The protocol accumulates bad debt because borrowers can prevent liquidations.

• Potential protocol insolvency: If enough borrowers exploit this issue, the lending pool could become insolvent due to uncollectable debt.

Proof of Concept (PoC)

Attack Scenario

1. User Borrows Funds

   • Calls borrow(amount) to receive reserve assets and mint an equivalent amount of debt tokens.

2. User Transfers Debt Tokens to Zero Address

   • The _update function ensures debt tokens can't be transferred to other users ( only burning and minting is allowed ), so user transfers debt tokens to address(0), effectively burning them.

   IDebtToken(reserve.reserveDebtTokenAddress).transfer(address(0), userBalance);

   • Since debt tokens are burned, the user's debt token balance becomes zero.

3. User Falls Below Liquidation Threshold

   • Normally, the liquidation process should burn debt tokens and seize the user's collateral.

   • However, finalizeLiquidation() calls:

   (uint256 amountScaled, uint256 newTotalSupply, uint256 amountBurned, uint256 balanceIncrease) =

   IDebtToken(reserve.reserveDebtTokenAddress).burn(userAddress, userDebt, reserve.usageIndex);

   • Since the user's debt token balance is already zero, this transaction reverts and liquidation fails**, because user has not debt token to be burned**.

4. User Keeps Borrowed Funds Without Repaying

   • The user has effectively erased their debt without repayment, preventing liquidation.

   • This leads to unrecoverable bad debt, causing a protocol deficit.