Core Contracts

Summary

Users are subject to liquidation after pool pause and unpause due to interest compounding implementation and missing close liquidation window.

Vulnerability Details

The LendingPool is allowed to be paused and unpaused (see pause() and unpause()). The LendingPool::repay and LendingPool::repayOnBehalf will revert if the pool is paused because of the whenNotPaused modifier.

The problem is that the borrow interest compounded calculation will not factor in the duration of pausing when a user cannot repay a loan.

Impact

Interests continuously compound with no repayment allowed. When unpaused, many accounts are vulnerable to liquidation.

Also, users might miss the close liquidation window. In the paused state, users cannot neither repay, nor close liquidation. If a liquidation process is initiated on a user, and the pool get paused within this time frame, the user would miss the window to repay his loan and close the liquidation, and would be liquidated.

Tools Used

Manual review.

Recommendations

Consider storing pause/unpause timestamp to allow skipping borrow interests compounding for the duration of the pause and extend the close liquidation time frame.