Core Contracts

Vulnerability Details

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L384-L386

The documentation for the _repay function states that if onBehalfOf is set to address(0), the function should default to repaying the caller’s (msg.sender’s) debt. However, the functions repayOnBehalf and _repay include the following checks:

if (onBehalfOf == address(0)) revert AddressCannotBeZero();

This condition prevents the intended default behavior, meaning that msg.sender cannot repay their own debt if they pass address(0) as the onBehalfOf parameter. Instead, the function will revert, blocking the repayment process.

Recommendations

Update the repayOnBehalf and _repay functions to allow address(0) as a valid input, defaulting to msg.sender’s debt repayment.