Core Contracts

Vulnerability Details

When user borrow's reserve assets using NFT's as collateral and if their position goes liquidatable and someone initiates liquidation by calling initiateLiquidation function after that if someone else repays the users position if user is not available at the moment by calling repayOnBehalf function but can't call closeLiquidation on users behalf and after this due to some emergency scenario LendingPool contract had to be paused and by this time user is back and they try to call closeLiquidation to stop their position from getting liquidated but can't call that function as contract is paused and during this paused time interval if their liquidationGracePeriod is expired and after that contract is unpaused again but now user can't call closeLiquidation function as their grace period is elapsed but their position has been repaid and when StabilityPool will try calling finalizeLiquidation function inside LendingPool by calling liquidateBorrower funcction from StabilityPool it will also revert due to check present on StabilityPool.sol:L455 for if userDebt is 0 which will be true hence it will revert and it will not be callable and when user tries to withdraw NFT's by calling withdrawNFT function in LendingPool contract it will also revert due to check present at LendingPool.sol:L289 if the user's position isUnderLiquidation, hence the NFT's are stuck in contract forever even though the borrow position is repaid

Impact

Due to issue in logic flow even after repaying position due to the closeLiquidation function cannot be called On Behalf of someone else and during emergency scenario if LendingPool contract goes in paused state and liquidationGracePeriod expires before user can call closeLiquidation the NFT's can be stuck in contract forever and user's can't withdraw it even though borrowed position is repaid and stability pool would also not be able to call finalizeLiquidation as there is check if userDebt is 0 which will revert in StablityPool's liquidateBorrower function and will revert due to it.

Recommendations

• First option - Add userAddress parameter in closeLiquidation so that it can be called by someone else on behalf of user after position is repaid on behalf of to lower the impact

• Second option - Call closeLiquidation internally from repay and repayOnBehalf functions