Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

LendingPool:initiateLiquidation should store liquidationGracePeriod, if owner change threshold user can be unfairly liquidated

foufrix

Summary

When entering liquidation, users have a time liquidationGracePeriod to repay their debts to avoid liquidation.

The problem is that initiateLiquidation do not store this value when entering liquidation.
A user can think that he has X days to repay, but the admin calls setParameter and updates the liquidationGracePeriod, which if lowered can block the user from repaying his debt and closeLiquidation()
Users can be unfairly liquidated.

Vulnerability Details

  1. liquidationGracePeriod = 7 days

  2. UserA has NFTa deposited and borrowed against

  3. market movement, initiateLiquidation(userA) is called and he is now under liquidation

  4. userA thinks he has 7 days to repay his debt and is gathering the money to pay back to avoid liquidation. He had emergency funds accessible in 3 days in case of those events

  5. 2 days pass

  6. setParameter is called by Owner, and liquidationGracePeriod = 1 days

  7. user cannot call closeLiquidation() and is liquidated by finalizeLiquidation()

Impact

The user is unfairly liquidated as he thought he had 7 days to repay his debts and ended up liquidated sooner than expected. There is no check in setParameter::liquidationGracePeriod that users are currently ina liquidation state. The value of the grace period should be stored at the time of the initialization of the liquidation

Tools Used

Manual

Recommendations

initiateLiquidation should store the liquidationGracePeriod when called:

+ mapping(address => uint256) public liquidationGraceTime;
​
function initiateLiquidation(address userAddress) external nonReentrant whenNotPaused {
if (isUnderLiquidation[userAddress]) revert UserAlreadyUnderLiquidation();
​
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
​
UserData storage user = userData[userAddress];
​
uint256 healthFactor = calculateHealthFactor(userAddress);
​
if (healthFactor >= healthFactorLiquidationThreshold) revert HealthFactorTooLow();
​
isUnderLiquidation[userAddress] = true;
liquidationStartTime[userAddress] = block.timestamp;
+ liquidationGraceTime[userAddress] = block.timestamp + liquidationGracePeriod;
​
emit LiquidationInitiated(msg.sender, userAddress);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

foufrix Submitter
3 months ago
inallhonesty Lead Judge
3 months ago
inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.