Incorrect Debt Amount in BorrowerLiquidated Event in StabilityPool::liquidateBorrower
Summary
The liquidateBorrower function is responsible for liquidating a borrower by repaying their debt in the LendingPool. However, the BorrowerLiquidated event emits the scaled debt (scaledUserDebt) instead of the actual debt (userDebt). This discrepancy can lead to misleading or incorrect reporting of liquidation amounts.
Vulnerability Details
The BorrowerLiquidated event currently emits scaledUserDebt, which is not the actual amount owed by the borrower.
The function retrieves userDebt from lendingPool.getUserDebt(userAddress), then scales it using WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt()), which adjusts the value using an index-based scaling factor.
The emitted value in BorrowerLiquidated(userAddress, scaledUserDebt) does not represent the real debt that was liquidated.
Impact
Users tracking liquidation amounts may overestimate debt repayment figures.
Tools Used
Manual Review
Recommendations
Modify the event emission to use userDebt instead of scaledUserDebt.
Lead Judging Commences
StabilityPool::liquidateBorrower emits scaled debt (scaledUserDebt) instead of actual debt (userDebt) in BorrowerLiquidated event, causing misleading liquidation reports
StabilityPool::liquidateBorrower emits scaled debt (scaledUserDebt) instead of actual debt (userDebt) in BorrowerLiquidated event, causing misleading liquidation reports
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.