Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Wrongly Inflated User Debt Calculation

ChainDefenders

Summary

In the StabilityPool.sol contract the liquidateBorrower function incorrectly calculates the scaledUserDebt by multiplying userDebt by the usage index again, leading to an incorrect debt amount.

Vulnerability Details

The vulnerability arises from the incorrect calculation of scaledUserDebt in the liquidateBorrower function. The userDebt value retrieved from the LendingPool is already multiplied by the usage index. Multiplying it again by the usage index results in an inflated debt amount. This incorrect calculation can lead to overestimation of the debt, causing the Stability Pool to transfer more funds than necessary during liquidation.

Impact

By overestimating the debt amount, the Stability Pool may transfer more funds than required to cover the user's debt. This can lead to unnecessary depletion of the Stability Pool's funds, reducing the available liquidity for other operations and potentially causing financial losses for the protocol. Additionally, it can result in unfair liquidations, where users are penalized more than they should be based on their actual debt.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, update the liquidateBorrower function to use the userDebt value directly without multiplying it again by the usage index. Here is an example of how to implement this:

function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
_update();
// Get the user's debt from the LendingPool.
uint256 userDebt = lendingPool.getUserDebt(userAddress);
​
if (userDebt == 0) revert InvalidAmount();
​
uint256 crvUSDBalance = crvUSDToken.balanceOf(address(this));
if (crvUSDBalance < userDebt) revert InsufficientBalance();
​
// Approve the LendingPool to transfer the debt amount
bool approveSuccess = crvUSDToken.approve(address(lendingPool), userDebt);
if (!approveSuccess) revert ApprovalFailed();
// Update lending pool state before liquidation
lendingPool.updateState();
​
// Call finalizeLiquidation on LendingPool
lendingPool.finalizeLiquidation(userAddress);
​
emit BorrowerLiquidated(userAddress, userDebt);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::liquidateBorrower double-scales debt by multiplying already-scaled userDebt with usage index again, causing liquidations to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!