Core Contracts

Summary

The LendingPool contract lacks a mechanism to incentivize liquidators to identify and liquidate multiple undercollateralized positions in bulk. The current initiateLiquidation function only allows liquidators to target one user at a time, which is inefficient and may lead to undercollateralized positions remaining unaddressed, increasing protocol risk.

Vulnerability Details

The initiateLiquidation function allows liquidators to initiate liquidation for a single user whose health factor is below the threshold. However, there is no mechanism to:

1. Identify Multiple Undercollateralized Positions: Liquidators cannot efficiently identify all users with health factors below the threshold.

2. Bulk Liquidate: Liquidators must call initiateLiquidation repeatedly for each user, which is gas-inefficient and time-consuming.

3. Incentivize Liquidators: There is no reward mechanism for liquidators to actively monitor and liquidate undercollateralized positions.

This inefficiency can lead to:

• Undercollateralized positions remaining unaddressed for extended periods.

• Increased risk of protocol insolvency due to unsecured loans.

• Reduced participation from liquidators due to lack of incentives.

POC (Proof of Concept)

1. Initial State:

   • 100 users have health factors below the liquidation threshold.

   • Each liquidation requires a separate transaction.

2. Liquidator Attempts to Liquidate:

   • The liquidator must call initiateLiquidation 100 times, paying gas fees for each transaction.

   • This process is inefficient and discourages liquidators from participating.

3. Result:

   • Many undercollateralized positions remain unaddressed due to the lack of bulk liquidation functionality and incentives.

Impact

• Undercollateralized positions remain unaddressed, increasing the risk of bad debt.

• Liquidators are discouraged from participating due to high gas costs and lack of incentives.

Tools Used

Manual Review

Recommendations

Add a function to allow liquidators to initiate liquidation for multiple users in a single transaction with introduce a reward mechanism for liquidators, such as a percentage of the liquidated collateral.