Summary

A vulnerability was identified in the liquidateBorrower function of the StabilityPool contract. The issue arises from an incorrect scaling operation applied to the user's debt, leading to an overestimation of the required liquidation amount.

Vulnerability Details

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/StabilityPool/StabilityPool.sol#L453

In the liquidateBorrower function, the user's debt is retrieved from the LendingPool contract using lendingPool.getUserDebt(userAddress). This value already accounts for interest and represents the present debt amount. However, the retrieved debt is then further scaled using WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt()), which incorrectly inflates the debt amount. The correct operation should be rayDiv rather than rayMul, as the debt value should not be compounded again.

Impact

The liquidation process overestimates the required debt repayment.

Tools Used

Manual review

Recommendations

The liquidation process overestimates the required debt repayment: