Core Contracts

Summary

The incorrect debt calculation in StabilityPool.sol will prevent legitimate liquidations by owners/managers as the returned debt amount does not account for elapsed time interest accrual.

Root Cause

In StabilityPool.sol and LendingPool.sol, the getUserDebt() function fails to account for interest accrued over elapsed time when calculating user debt, while finalizeLiquidation() does update the reserve state with current interest.

Internal pre-conditions

1. Time needs to elapse since reserve.lastUpdateTimestamp

2. User needs to have debt in the lending pool

3. Owner/manager needs to attempt liquidation through StabilityPool.sol#liquidateBorrower()

Attack Path

1. Owner/manager calls liquidateBorrower() with a user's address

2. Function fetches debt via getUserDebt() which returns stale debt value

3. finalizeLiquidation() updates reserve state with current interest

4. Transaction reverts due to insufficient balance check since actual debt is higher than fetched amount

Impact

The protocol owners/managers cannot execute legitimate liquidations through the StabilityPool, potentially leading to increased bad debt accumulation.

Code References

Recommended Mitigation

Modify LendingPool.sol#getUserDebt() to calculate and return the current debt including accrued interest based on elapsed time since last update.