Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: medium
Valid

closeLiquidation() requires full debt repayment creating unnecessary burden on the system

Summary

The current LendingPool implementation forces full debt repayment to close liquidation,
which deviates from standard practice of partial repayments.

Vulnerability Details

Expected Behavior for Exiting Liquidation

Lending protocols (e.g., Aave, Compound) allow partial repayment to restore a healthy healthFactor.

To exit liquidation, a user should:

  • Repay enough debt so their health factor is above 1e18 (safe zone).

  • Not necessarily repay the entire debt.

Potential Issue with Current Implementation

The following check in closeLiquidation ensures that the current userDebt > DUST_THRESHOLD ( = 1e6),
Meaning the user has fully paid pack the debt.

if (userDebt > DUST_THRESHOLD) revert DebtNotZero();

Liquidation should only prevent bad debt,
not force full repayment if the user is still within safe collateralization levels.

Even though it can be assumed as design choice,
This deserves attention because it puts the unncessary burden on the users and the system,
as there may not be enough entities left to fully repay the debt of every user under liquidation.

Impact

Requiring full repayments puts the system and users under unncessary burden
as there may not be enough entities or fund left to fully repay the debt of every user under liquidation.

Recommendations

Instead of full debt repayment, closeLiquidation()
should only require enough repayment to bring the health factor above the liquidation threshold (1e18).

A reference implementation

function closeLiquidation(address user, uint256 amountToRepay) external {
require(isUnderLiquidation[user], "User is not under liquidation");
// Ensure the user is repaying at least enough to get health factor above threshold
uint256 oldHealthFactor = calculateHealthFactor(user);
require(oldHealthFactor < 1e18, "User is already safe");
// Repay debt (either fully or partially)
repay(amountToRepay,user ); // Assume this function reduces `userDebt`
uint256 newHealthFactor = calculateHealthFactor(user);
require(newHealthFactor >= 1e18, "Repayment insufficient to exit liquidation");
// Remove from liquidation mapping
isUnderLiquidation[user] = false;
liquidationStartTime[userAddress] = 0;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::finalizeLiquidation() never checks if debt is still unhealthy

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.