Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Some questionable calculations in the `StabilityPool::liquidateBorrower` function may lead to bad liquidation reverts

kirobrejka

Summary

This happens due to the following line of code in the StabilityPool::liquidateBorrower functio:

function liquidateBorrower(
address userAddress
) external onlyManagerOrOwner nonReentrant whenNotPaused {
// Get the user's debt from the LendingPool.
uint256 userDebt = lendingPool.getUserDebt(userAddress);
​
uint256 scaledUserDebt = WadRayMath.rayMul(
userDebt,
lendingPool.getNormalizedDebt()
);
​
if (userDebt == 0) revert InvalidAmount();
uint256 crvUSDBalance = crvUSDToken.balanceOf(address(this));
if (crvUSDBalance < scaledUserDebt) revert InsufficientBalance();
​

Vulnerability Details

When comparing the user debt and the crvUSD balance of the contract, the most important thing is both amounts to be denominated in crvUSD. This is not the case here, since the LenidingPool::getUserDebt function already makes the scaledUserDebt into crvUSD amount as can be seen here:

function getUserDebt(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
@> return user.scaledDebtBalance.rayMul(reserve.usageIndex);
}
​

This means that the following block of code in the StabilityPool::liquidateBorrower is actually useless and can even result in bad reverts for the protocol since it inflates the amount of crvUSD for the liquidation:

@> uint256 scaledUserDebt = WadRayMath.rayMul(
userDebt,
lendingPool.getNormalizedDebt()
);

Impact

This may result in some improper liquidation reverts because of the following check

if (crvUSDBalance < scaledUserDebt) revert InsufficientBalance();

Tools Used

Manual Review

Recommendations

Cut the following line from the function:

​
@> uint256 scaledUserDebt = WadRayMath.rayMul(
userDebt,
lendingPool.getNormalizedDebt()
);
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::liquidateBorrower double-scales debt by multiplying already-scaled userDebt with usage index again, causing liquidations to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.