Core Contracts

Summary

The borrow function allows a user to borrow an amount of reserve assets. It checks that the user has enough collateral to cover the new debt. However, the collateral check incorrectly applies the liquidation threshold to the user debt instead of the collateral value. This incorrect implementation allows users to borrow an amount higher than the collateral provided, potentially leading to undercollateralized positions, bad debts, and protocol insolvency

Vulnerability Details

Here's the collateral check from borrow

The check is incorrect because It applies liquidationThreshold to userTotalDebt instead of collateralValue.

Example scenario:

Values:

• collateralValue = 100 ETH

• borrow amount = 120 ETH

• userTotalDebt = 120 ETH(assuming there's no previous debt)

• liquidationThreshold = 80%

Current calculation (incorrect): 100 ETH < 96 ETH (120 * 80%) Check passes since 100 > 96, allowing borrowing

Correct calculation: (100) * 80% = 80 ETH < 120 ETH Check should fail as 80 < 120, preventing borrowing

Impact

• Users can borrow more than their deposited collateral

• Risk of bad debts and protocol insolvency

Tools Used

Manual

Recommendations

Fix the collateral check