Core Contracts

Summary

The borrow() function in the LendingPool contract uses percentMul instead of percentDiv when checking if a user has sufficient collateral, allowing users to borrow more than they should and create undercollateralized positions.

Vulnerability Details

The key issue lies in this check in the borrow() function:

This is incorrect because:
The liquidationThreshold is set to 80% (8000 basis points) in the contract:

When using percentMul, the calculation effectively becomes:

This means the check is verifying if:

The difference is significant:

• Current (incorrect): For 100 tokens of debt, only needs 80 tokens of collateral

• Correct: For 100 tokens of debt, needs 125 tokens of collateral (100/0.8)

This check in borrow function also does not align with the health factor calculation in the contract:

The health factor formula shows that to maintain a health factor ≥ 1; (collateralValue * 0.8) / debt ≥ 1 which simplifies to collateralValue ≥ debt / 0.8 but the check in borrow function uses collateralValue < (userTotalDebt * 0.8) which is wrong;

PoC

1. Alice has 100 tokens worth of NFT collateral

2. The liquidation threshold is 80%

3. Alice attempts to borrow 100 tokens

4. Current check: 100 < 100 * 0.8 (80) - This passes

5. Alice receives 100 tokens loan

6. Alice's health factor: (100 * 0.8) / 100 = 0.8 - Undercollateralized

Impact

Users can create undercollateralized positions from the start, putting the protocol at immediate risk of bad debt.

Tools Used

Manual Review

Recommendations

Change the check in the borrow() function to use percentDiv instead of percentMul: