Core Contracts

Summary

The deposit function does not enforce a minimum deposit amount, allowing users to deposit very small amounts (e.g., 1 wei). This can lead to the creation of small, uneconomical positions that are difficult or costly to liquidate, increasing the risk to the protocol and other users.

Vulnerability Details

** Root Cause**:

• The deposit function does not include a check for a minimum deposit amount.

• Users can deposit very small amounts, creating positions that are not worth liquidating due to high gas costs relative to the value of the position.

Impact

• Small Positions: Small deposits can result in positions that are uneconomical to liquidate.

• Inefficient Liquidation: Liquidators may avoid small positions because the gas costs outweigh the potential rewards.

• Increased Risk: Small, undercollateralized positions may remain un-liquidated, increasing the risk to the protocol and other users.

PoC

1. A user deposits a very small amount of reserve assets (e.g., 1 wei) and receives a corresponding amount of RTokens.

2. The user's position becomes undercollateralized, but the liquidation process is not initiated because the gas costs outweigh the potential rewards.

3. The small position remains un-liquidated, increasing the risk to the protocol and other users.

Tools Used

Manual Review

Recommendations

1. Implement Minimum Deposit Amount:

• Add a check to ensure the deposit amount is above a minimum threshold.

• Example:

2. Update deposit Function:

• Add the minimum deposit amount check to the deposit function.

• Example: