Core Contracts

Summary

When a protocol is unpaused there is no grace period, it is possible that user position become unhealthy in this pause window cause and when the unpause is called the position will be marked liquidable or if it is already in auction then and auction time is over then it can be liquidated instantly.

Vulnerability Details

Protocol uses pausing mechanism everywhere in LendingPool. If the protocol is paused all the operation are halted including repay , If the user’s position is already marked for liquidation and his grace period has just started, due to the pause state user don’t have a ability to secure his collateral by repaying the loan. This will cause his collateral to be instantly liquidable if the protocol unpause after the liquidation grace period is over.

Impact

User will lose his collateral because of the pause state.

Recommendations

User should be able to repay when protocol is paused or there should be extra grace period after unpause before the finalizeLiquidation can be called.