Core Contracts

Summary

Users would be unfairly liquidated if the protocol is paused and later reactivated

Vulnerability Details

The protocol uses a global variable in solidity block.timestamp to check if a user has exceeded their GracePeriod when trying to call the closeliquidation function and stop the liquidation process on the user. This is an issue because the function can only be called WhenNotPaused, whereas their GracePeriod still reads during the paused duration of the function. When the closeliquidation function is paused, a user can call the function _repay and repay their debt. After repaying the debt, the user would be unable to call the closeliquidation function and stop the liquidation process that has been initiated. If the function is reactivated after the GracePeriod has expired and the the user calls the closeliquidation function, it would revert with error GracePeriodExpired. The user would then be forcefully liquidated.

Impact

In the event of the closeliqidation function being paused, user would be unable to call closeliquidation and would be forcefully liquidated if the paused duration of the function exceeds their GracePeriod.

Tools Used

Manual Review

Recommendations

The whenNotPaused modifier should be removed from the closeliquidation function, thereby allowing users to call closeliquidation, and stop the liquidation process after repaying their debt.