Core Contracts

Summary

The repay function in LiquidityPool includes the whenNotPaused modifier, preventing repayments when the contract is paused. This creates a critical issue: if the contract is paused during a borrower's 7-day grace period, they will be unable to repay their debt, leading to forced liquidations even if they were able to cover their obligations.

Vulnerability Details

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/LendingPool/LendingPool.sol#L375

• If the contract is paused during the grace period, users are blocked from repaying their loans.

• This violates the intended logic of allowing repayments within the grace period before liquidation.

• Malicious actors or protocol mismanagement could exploit this to force unnecessary liquidations.

Impact

Borrowers could lose their collateral even when they have funds available to repay.

Tools Used

Manual review

Recommendations

Remove the whenNotPaused modifier from repay to ensure borrowers can always settle debts within the grace period