Core Contracts

Summary

The LendingPool does not automatically close a user’s liquidation state after the user repays their debt. As a result, even if a user clears their debt (i.e. the debt falls below the DUST_THRESHOLD), the liquidation remains active because the contract requires a manual call to LendingPool::closeLiquidation(). This creates a risk that users may inadvertently remain under liquidation and face unexpected consequences even after clearing their debt.
In the LendingPool contract, the function used to close liquidation is defined as follows:

Vulnerability Details

In the LendingPool contract, the function used to close liquidation is defined as follows:

The problem is that even after a user has repaid enough debt so that their debt (user.scaledDebtBalance) is below the DUST_THRESHOLD, their liquidation state is not updated automatically. They must manually call closeLiquidation() to end the liquidation state. This dependency on manual intervention can lead to cases where users inadvertently remain under liquidation, hampering their ability to fully utilize the protocol even after clearing their debt.

Impact

• User Experience Degradation: Users may be unaware of the need to manually close liquidation, leading to confusion and potential penalties or restricted functionality.

• Operational Risk: Remaining under liquidation despite full repayment can adversely affect the user’s positions and interaction with the protocol.

• Potential Exploitation: An attacker might exploit this behavior by delaying the closure, possibly affecting collateral management or delaying recovery of user privileges.

Tools Used

• Manual Code Review

• Unit Testing (as demonstrated by tests in LendingPool.test.js)

Recommendations

After processing a repayment, check if the user is under liquidation and if their scaled debt balance is below the DUST_THRESHOLD and if they are automate the close liquidation process.