Core Contracts

Summary

The setParameter function does not validate the value when updating the healthFactorLiquidationThreshold parameter. This omission means that the owner can set this critical threshold to any arbitrary value—even values that are too low or otherwise unsafe.

Vulnerability Details

The root cause is a missing require statement in the branch that handles OwnerParameter.HealthFactorLiquidationThreshold. Unlike other parameters, no bounds or sanity checks are applied, leaving the threshold completely unrestrained.

Explain in relevant detail using numbers and creating scenarios demonstrating the impact
For example, assume the protocol expects a minimum threshold of 1e18 (i.e., a 1:1 ratio) for safe operations. If the threshold is mistakenly set to 0.5e18:

A user with a health factor of 0.8e18 (80%) might not be liquidated even though their collateral is insufficient.
Conversely, if the threshold is set excessively high (e.g., 2e18), even healthy positions could be liquidated unnecessarily, harming users and reducing overall system stability.

Impact

Without proper validation, the health factor threshold could be set below a safe minimum. This might cause risky positions to be ignored for liquidation (if set too low) or trigger premature liquidations (if set too high), exposing the protocol to increased bad debt or unfair user losses.

Recommendations

Add validation in the setParameter function for HealthFactorLiquidationThreshold. For example: