Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unrestricted health factor adjustment leads to potential insolvency

4eyes

Summary

The setParameter() in BoostController.sol allows the contract owner to set the healthFactorLiquidationThreshold to 0, effectively disabling the liquidation process. While the likelihood of this happening is small, as the owner is assumed to be a trusted role, it still poses a significant risk to the protocol’s solvency.

Vulnerability Details

The setParameter function allows the contract owner to modify various protocol parameters, including healthFactorLiquidationThreshold. There is no validation to ensure that healthFactorLiquidationThreshold is at least equal to BASE_HEALTH_FACTOR_LIQUIDATION_THRESHOLD. If set to 0, the liquidation condition in initiateLiquidation will never be met, preventing any liquidation from occurring.

else if (param == OwnerParameter.HealthFactorLiquidationThreshold) {
healthFactorLiquidationThreshold = newValue;
emit LiquidationParametersUpdated(liquidationThreshold, healthFactorLiquidationThreshold, liquidationGracePeriod);
}
uint256 healthFactor = calculateHealthFactor(userAddress);
if (healthFactor >= healthFactorLiquidationThreshold) revert HealthFactorTooLow();

If healthFactorLiquidationThreshold == 0, then healthFactor >= 0 is always true, preventing all liquidations.

Impact

If liquidations are disabled:

  1. Bad debt accumulation: Borrowers can take out loans and never face liquidation, leading to potential protocol insolvency.

  2. Protocol collapse: If too many bad loans accumulate, the protocol may become undercollateralized.

PoC

Contract owner calls:

setParameter(OwnerParameter.HealthFactorLiquidationThreshold, 0);
​

A borrower takes a loan and allows their collateral to drop below safety levels.
Any attempt to liquidate the borrower will fail due to:

if (healthFactor >= healthFactorLiquidationThreshold) revert HealthFactorTooLow();

Since healthFactorLiquidationThreshold is 0, liquidation is impossible.

Tools Used

Manual review

Recommendations

A validation check should be added to setParameter to prevent healthFactorLiquidationThreshold from being set below BASE_HEALTH_FACTOR_LIQUIDATION_THRESHOLD:

else if (param == OwnerParameter.HealthFactorLiquidationThreshold) {
require(newValue >= BASE_HEALTH_FACTOR_LIQUIDATION_THRESHOLD, "Threshold too low");
healthFactorLiquidationThreshold = newValue;
emit LiquidationParametersUpdated(liquidationThreshold, healthFactorLiquidationThreshold, liquidationGracePeriod);
}

This ensures that liquidations remain functional and protects the protocol from insolvency.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!