Core Contracts

Summary

The LTV check is incorrect in the 2 functions which allows users to borrow more than what they have kept as collateral.

Vulnerability Details

In both the withdrawNFT and the borrow functions, the LTV check done is wrong. Essentially allowing users to keep less as collateral than what they borrow/withdraw. A malicious user can thus use this to get instant profits, leading to a loss for the protocol.

Assume liquidationThreshold = 5000 (50%), user has deposited collateral worth 100 tokens.

In the borrow function:

if the user supplies amount = 150 tokens; the check does the following :
100 < 150.percentMul(5000) => 100 < 150*5000/10000 = 75 => 100 < 75 which is false and thus will not revert.
Thus the user has essentially withdrawn 150 tokens by keeping 100 tokens worth collateral

Impact

Drain the protocol. Lending pool doesnt make sense

Tools Used

manual Review

Recommendations

update them as follows:
Borrow function:

if(userTotalDebt > collateralValue.percentMul(liquidationThreshold)) revert