Core Contracts

Summary

The calculation of scaledUserDebt in the StabilityPool::liquidateBorrower is wrong. This causes the wrong amount of crvUSDToken to be approved for transfer during liquidation. Hence, the transfer will always fail.

Wrong scaledUserDebt calculation -> Wrong Approval Amount -> Transfer in liquidation reverts.

Vulnerability Details

In the StabilityPool::liquidateBorrower, we have the following code:

Looking at the above code, the function calculates the scaledUserDebt (borrowed tokens + interest) by multiplying userDebt and lendingPool.getNormalizedDebt() (which is the usageIndex). This calculation is wrong.

In all other functions, the scaled amount is calculated as follows:

Hence, the correct calculation is scaledAmount = amount / usageIndex, and not scaledDebt = userDebt * usageIndex. Here, 'Amount' and 'Debt' represent the same borrowed tokens.

Impact

Due to the calculation being wrong, the amount of tokens approved is direct affected as shown below:

Hence, when the final function in the liquidation is called (finalizeLiquidation), the actual amountScaled will revert on transfer due to insufficient approval:

In the burn function above, the amountScaled is calculated as:

In conclusion, the liquidation will always revert due to the wrong calculation causing the wrong amount being approved for transfer from the StabilityPool to the LendingPool.

Tools Used

Manual review.

Recommendations

Just need to change the multiplication to division.