Submission Details
Severity:
`StabilityPool.liquidateBorrower()` Is Impossible Due to Not Holding Any `crvUSDToken`
Summary
The StabilityPool.liquidateBorrower() function is designed to liquidate borrowers using crvUSDToken. However, the StabilityPool does not currently hold any crvUSDToken, making liquidation impossible.
Vulnerability Details
The StabilityPool.liquidateBorrower() function attempts to repay user debt with crvUSDToken. In the current implementation, there is no logic allowing the StabilityPool to hold any crvUSDToken. Consequently, liquidation cannot occur.
function liquidateBorrower(address userAddress) external onlyManagerOrOwner nonReentrant whenNotPaused {
_update();
// Get the user's debt from the LendingPool.
uint256 userDebt = lendingPool.getUserDebt(userAddress);
uint256 scaledUserDebt = WadRayMath.rayMul(userDebt, lendingPool.getNormalizedDebt());
if (userDebt == 0) revert InvalidAmount();
uint256 crvUSDBalance = crvUSDToken.balanceOf(address(this));
if (crvUSDBalance < scaledUserDebt) revert InsufficientBalance();
// Approve the LendingPool to transfer the debt amount
461 bool approveSuccess = crvUSDToken.approve(address(lendingPool), scaledUserDebt);
if (!approveSuccess) revert ApprovalFailed();
// Update lending pool state before liquidation
lendingPool.updateState();
// Call finalizeLiquidation on LendingPool
lendingPool.finalizeLiquidation(userAddress);
emit BorrowerLiquidated(userAddress, scaledUserDebt);
}
Impact
Liquidation is impossible due to the absence of crvUSDToken.
Tools Used
Manual review
Recommendations
Implement logic that allows the StabilityPool to hold crvUSDToken.
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
StabilityPool design flaw where liquidations will always fail as StabilityPool receives rTokens but LendingPool expects it to provide crvUSD
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.