Core Contracts

Summary

The liquidation process in the protocol is unfair due to asymmetric permissions and incomplete Health Factor (HF) checks. While any user can initiate liquidation or repay a borrower's debt, only the borrower can close the liquidation (if the HF is restored). Additionally, the finalizeLiquidation function in LendingPool contract does not check the HF before finalizing the liquidation, while liquidateBorrower in StabilityPool contract allows to avoid this problem only if debt was fully repaid.

if (userDebt == 0) revert InvalidAmount();

This can lead to unfair loss of collateral even if the HF has been restored but the debt is not fully repaid.

Vulnerability Details

The issue arises from the following design flaws:

Asymmetric Permissions:

• Any user can initiate liquidation or repay a borrower's debt.

• Only the borrower can close the liquidation (if the HF is restored).

• Only the StabilityPool can finalize the liquidation after the grace period.

Incomplete Health Factor Check in finalizeLiquidation and liquidateBorrower:

• Both functions do not check the borrower's HF before transferring their collateral to the StabilityPool.

• This means that even if the HF has been restored (e.g., due to partial repayment of the debt), the liquidation can still be finalized, resulting in the unfair loss of collateral.

Example Scenario:

• User A (borrower) has a debt of 100 tokens and collateral in the form of NFTs.

• User B repays 50 tokens of User A's debt, restoring the HF above the threshold.

• User A cannot close the liquidation (e.g., due to lack of access to their wallet).

• After the grace period, the StabilityPool calls finalizeLiquidation, transferring User A's NFTs to the StabilityPool, even though the HF has been restored.

Impact

• Unfair Loss of Collateral:

Borrowers can lose their collateral even if their HF has been restored.

• Reduced Trust in the Protocol:

Users may lose trust in the protocol due to unfair liquidation practices.

• Financial Loss for Borrowers:

Borrowers may suffer significant financial losses if their collateral is unfairly liquidated.

Tools Used

Manual code review.

Recommendations

• Rework closeLiquidation LendingPool funtion, adding userAddress param:

• Add checking on HF in finalizeLiquidation or liquidateBorrower functions before finalization