Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Debt Scaling Prevents Borrower Liquidation

fromeo_016

Summary

The liquidateBorrower function incorrectly scales the user's debt a second time, causing an inaccurate balance check. This results in unnecessary reverts, preventing liquidations from occurring as intended.

Vulnerability Details

The issue occurs due to double scaling of userDebt:

uint256 userDebt = lendingPool.getUserDebt(userAddress); // Already in underlying asset units
​
uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt()); // @audit further scaling when it's already in correct units

  • The function getUserDebt already returns the debt in underlying asset units, meaning no further scaling is required.

  • The additional scaling (rayMul(userDebt, lendingPool.getNormalizedDebt())) inflates the value, leading to an incorrect balance check:

if (crvUSDBalance < scaledUserDebt) revert InsufficientBalance(); // Always reverts due to over-scaling

  • Since scaledUserDebt is artificially higher than it should be, the function always reverts, blocking valid liquidations.

Impact

This issue completely prevents borrower liquidations, leading to:

  • Accumulation of bad debt, as liquidations are blocked.

  • Risk to protocol solvency, since positions that should be liquidated remain open.

  • Stability Pool funds not being utilized**, affecting ecosystem health.

Tools Used

Manual Review

Recommendations

Fix the incorrect scaling
Remove the unnecessary rayMul operation:

uint256 userDebt = lendingPool.getUserDebt(userAddress); // Correct units, no further scaling needed

And update the balance check:

if (crvUSDBalance < userDebt) revert InsufficientBalance(); // Now correctly compares against available funds

And update the approval amount:

bool approveSuccess = crvUSDToken.approve(address(lendingPool), userDebt); // Approve the correct amount
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::liquidateBorrower double-scales debt by multiplying already-scaled userDebt with usage index again, causing liquidations to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!