Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Debt Scaling in liquidateBorrower Function Leading to Failed Liquidations

aksoy

Summary

The liquidateBorrower function in the StabilityPool contract incorrectly scales the user's debt by multiplying it with the usage index, even though the getUserDebt function already returns the scaled debt. This results in the scaledUserDebt being higher than it should be, causing liquidations to fail even when the StabilityPool has sufficient funds to cover the actual user debt. This flaw prevents the protocol from liquidating undercollateralized positions, increasing the risk of bad debt.

Vulnerability Details

The liquidateBorrower function retrieves the user's debt using getUserDebt. and multiplies it with usage index again. This results in the scaledUserDebt being double-scaled, as userDebt is already scaled by the usage index. If StabilityPool has only funds enough to cover user real dept not increased dept, liquidateBorrower would fail.

function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
_update();
// Get the user's debt from the LendingPool.
uint256 userDebt = lendingPool.getUserDebt(userAddress);
//@audit this is already scaled
uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt());
​
if (userDebt == 0) revert InvalidAmount();
​
uint256 crvUSDBalance = crvUSDToken.balanceOf(address(this));
if (crvUSDBalance < scaledUserDebt) revert InsufficientBalance();
​
function getUserDebt(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
return user.scaledDebtBalance.rayMul(reserve.usageIndex);
}
​

Impact

Liquidations may fail even when the StabilityPool has sufficient funds to cover the actual user debt.

Tools Used

Manual

Recommendations

The liquidateBorrower function should not scale the debt again, as getUserDebt already returns the scaled debt.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::liquidateBorrower double-scales debt by multiplying already-scaled userDebt with usage index again, causing liquidations to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.