Core Contracts

Summary

In LendingPool contract, when an address is under liquidation it has sometime to repay its debt and get out of liquidation. However, it's possible that during that time the position becomes insolvent (their NFTs are valued less than their borrowed amount).

Vulnerability Details

The liquidation process in LendingPool has 3 steps:

1. initiateLiquidation puts an address with a bad health factor under liquidation. This address now has liquidationGracePeriod time to repay his debt.

2. Grace period time is when the address can repay the debt and call closeLiquidation which will remove the address from being under liquidation.

3. If grace period has passed, finalizeLiquidation can be called by the StabilityPool to complete the process.

It's possible however that during grace period the NFT becomes of less value than the borrowed amount. At this case, the protocol will lose money since its the one that pays for the liquidation and receives the user's NFTs.

Impact

Grace period allows for positions to become insolvent and the protocol to lose money to liquidate them.

Tools Used

Manual review

Recommendations

Remove the grace period and make every position instantly liquidatable.