Core Contracts

Summary

The protocol currently prevents users from repaying their debt (LendingPool:::repay) and LendingPool:::closeLiquidation when it is paused using the whenNotPaused modifier. In the case where the user has a near-liquidation risk, the pause could prevent them from acting, potentially causing them to lose their collateral.

Vulnerability Details

The function repay is a critical function in the protocol that allows users to repay their debt. It is currently modified by whenNotPaused, meaning that users cannot repay their debt when the contract is paused.
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/LendingPool/LendingPool.sol#L375

The closeLiquidation function allows users to close a liquidation by repaying their debt within a specified grace period. It is also restricted by the whenNotPaused modifier:

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/LendingPool/LendingPool.sol#L468

Impact

Users will not be able to repay their debt or close their liquidation status when the protocol is paused. This increases the risk of insolvency, as users cannot manage their liabilities.

Tools Used

Manual code review

Recommended Mitigation

Allow repay and closeLiquidation during pause