Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Liquidations do not rebalance liquidity, missing on yield

charlescheerful

Vulnerability Details

All protocol functions that deposit or withdraw underlying asset call _rebalanceLiqudiity(). This is so the protocol can deposit on the CRV Vault the desired % of liquidity to gain extra yield.

However the finalizeLiquidation() does alter the amount of underlying assets on the system, by adding more due to repayment of bad debt, yet it does not rebalance the liquidity. It moves assets in the underlying token asset here.

Impact

Liquidations won't and should deposit funds in the CRV Vault if needed, missing on extra yield until someone else executes a rebalancing action.

Recommendations

Add _rebalanceLiquditiy() at the end of LendingPool::finalizeLiquidation().

function finalizeLiquidation(address userAddress) external nonReentrant onlyStabilityPool {
//code...
+ _rebalanceLiquidity();
emit LiquidationFinalized(stabilityPool, userAddress, userDebt, getUserCollateralValue(userAddress));
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LendingPool::finalizeLiquidation or repay doesn't call _rebalanceLiquidity, leaving excess funds idle instead of depositing them in Curve vault for yield

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.