Core Contracts

Summary

Users are able to borrow funds from the LendingPool contract through over-collateralization. If the value of the collateral compared to the borrowed assets falls below a certain threshold, the borrower is subject to getting liquidated. It is a 2 step process. The first step is for an external user to call the initiateLiquidation(...) and after a grace period passes, during which the borrower can repay his debt and "cancel" the liquidation process, the liquidation can be finalized through the finalizeLiquidation(...). The problem is that the current grace period is 3 days and the minimum grace period, which can be set by the owner, is 1 day. If the price of either the collateral drops or the borrowed assets rises too fast, what can happen is that the borrowed funds are worth more than the collateral. Since liquidations are not instant or take too long to get finalized, the protocol can accrue bad debt due to insolvent positions.

Vulnerability Details

Let's take an example - Alice deposits an NFT as collateral, which initially has a value of 10,000 USD and borrows assets worth 7,500 USD. Let's also assume the liquidation threshold is 0.8. So, the price of the borrowed assets increases to 8,000 USD and she becomes subject to liquidation. Bob calls initiateLiquidation(...) in order to start the liquidation process. However, since the grace period for Alice is 3 days (i.e. she has 3 days to pay off her debt before getting liquidated), she decides to do not do it. After 3 days, the price of the borrowed assets has become 10,500 USD, meaning even if she gets liquidated, the protocol has accrued bad debt. When grace periods, that are too long, are being used, the chances of "positions" becoming insolvent, increases drastically.

Impact

Accrual of bad debt for the protocol due to insolvent positions

Tools Used

Manual analysis

Recommendations

Make liquidations either instant or reduce their duration