Core Contracts

Summary

The LendingPool protocol only accepts underlying asset (crvUSD) for repayments and debt resolution, making the system vulnerable to liquidity shortages that could prevent users from repaying debts or avoiding liquidations.

Vulnerability Details

The protocol currently only allows repayments using the underlying crvUSD token. During periods of low liquidity or market stress, users holding rTokens (representing their share of the lending pool) cannot use these tokens to repay their debt or avoid liquidation. This becomes particularly problematic in scenarios where:

1. A user wants to repay their debt but cannot acquire enough underlying crvUSD from the market

2. The user holds equivalent value in rTokens but cannot use them

This limitation creates a systemic risk where users might face forced liquidations despite having an equivalent value locked in the protocol as rTokens.

Impact

• Users may face unfair liquidations despite having equivalent value in rTokens

Tools Used

Manual review

Recommendations

Implement a dual repayment system that accepts both underlying crvUSD and rTokens