Core Contracts

Summary

The borrow function currently allows users to borrow up to the liquidation threshold of their collateral value. This can lead to excessive borrowing with no safety margin, increasing the risk of immediate liquidation if collateral depreciates or debt grows due to interest. To prevent this, a stricter borrowing limit should be implemented, ensuring users can only borrow a portion of their collateral while maintaining a buffer against market fluctuations.

Vulnerability Details

Issue

• The function permits borrowing up to 80% of the collateral value, leaving no room for collateral depreciation or increasing debt.

• For example, with 1,000 collateral, a user can borrow 1,000 tokens under an 80% liquidation threshold, leaving no buffer.

• If the collateral value drops slightly or debt accrues, liquidation is triggered immediately after borrowing.

• The following condition does not effectively prevent over-borrowing:

• This check still allows borrowing amounts that would result in immediate liquidation.

Impact

Higher Risk of Liquidation

• Users may unknowingly borrow too much, resulting in forced liquidations due to even minor fluctuations in collateral value.

• The protocol may suffer unintended consequences if users over-leverage and get liquidated frequently.

• Borrowing should allow a margin of safety rather than allowing users to max out their collateral.

Tools Used

• Manual inspection of the borrow function logic and collateral evaluation.

Recommendations

Introduce a More Conservative Borrowing Cap

• Instead of allowing users to borrow up to the full liquidation threshold, enforce a stricter limit, ensuring a safety buffer.

• Implement a percentage cap lower than the liquidation threshold to prevent immediate liquidation risk.

Example Fix

• This ensures that users can only borrow up to a safer percentage of their collateral, reducing the risk of liquidation due to market fluctuations.