Core Contracts

Summary

If the contract goes into a pausable state when multiple users are under liquidation, they'll be unable to repay and close their liquidation as the liquidationGracePeriod will expire when the contract is paused.

Vulnerability Details

A user can be liquidated if his health factor goes below the healthFactorLiquidationThreshold.

In order to close his liquidation, the user is allowed a GRACE PERIOD of 3 DAYS(currently) from the date he went under liquidation.

If he's able to repay his debt via repay() and call closeLiquidation() before the grace period expires, he'll be able to close his liquidation and get back his collateral.
closeLiquidation()

However, there lies an issue here. If the contract goes into a pausable state after the liquidation for a user has started, then he'll be unable to repay his debt even though he has the necessary funds to close his liquidation.

This would result in the user getting liquidated without any fault of his own even though he had the necessary funds to close his liquidation.

Impact

Users will lose their collateral

Tools Used

Manual

Recommendations

People can also repay their debt at the last moment, and if for any reason the contract is paused, they'll lose their collateral.

Consider removing the Pausable modifier, or either increase the Grace Days.