Race Condition Between Repayment and Liquidation Closure
Summary
The LiquidityPool::closeLiquidation function allows a user to exit liquidation only if their debt has been fully repaid within the grace period. However, a race condition exists:
A user repays their debt in one transaction.
Then, they attempt to close liquidation in a separate transaction.
If the block timestamp increases beyond the grace period in between, the second transaction fails.
Vulnerability Details
If a user repays their debt just before the grace period expires, they might not have enough time to execute closeLiquidation before the deadline.
Impact
Unrecoverable liquidation: Users could lose their collateral even after full repayment.
Tools Used
Mnual review
Recommendations
Merge repayment and liquidation closure into a single function
Lead Judging Commences
A borrower can LendingPool::repay to avoid liquidation but might not be able to call LendingPool::closeLiquidation successfully due to grace period check, loses both funds and collateral
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.