Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Function liquidateBorrower Scales User Debt Twice in stability pool

aycozynfada

Summary

The liquidateBorrower function in the provided Solidity code erroneously scales the user's debt twice. This occurs because the user's debt has already been scaled in the lending pool, and the function applies another scaling operation, resulting in incorrect debt calculations.

Vulnerability Details

The liquidate borrower function liquidates bad debts through the stability pool, which calls finalizeLiquidation function in the lending pool. Before liquidating the bad debt the stabilityPool#liquidateBorrower function scales the user debt about to be liquidated, the issue however lies in the sense that user debt have been scaled when getting the user debt details from the lending pool leading to case of double scaling.

In the below code the function gets the user debt from the lending pool and scales it with the debt index of the liquidity pool, however the scaling had been carried out already while getting user debt..

function liquidateBorrower(
address userAddress
) external onlyManagerOrOwner nonReentrant whenNotPaused {
_update();
// Get the user's debt from the LendingPool.
uint256 userDebt = lendingPool.getUserDebt(userAddress); //debt already scaled
uint256 scaledUserDebt = WadRayMath.rayMul(//user debt re-scaled
userDebt,
lendingPool.getNormalizedDebt()//scales user debbt twice
);
​

user debt function with already scaled user debt below

function getUserDebt(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
return user.scaledDebtBalance.rayMul(reserve.usageIndex);//returns scaled debt to stability pool
}
​

Impact

By scaling the user's debt twice, the function produces an incorrect debt amount. This could have several negative implications:

  • Users might end up with higher-than-expected debt amounts, leading to potential financial losses or unfair liquidations.

Tools Used

manual review

Recommendations

To address this issue, remove the second scaling operation from the liquidateBorrower.

By making this change, the function will correctly handle the user’s debt without applying redundant scaling, ensuring accurate debt calculations and maintaining the integrity of the lending platform.

function liquidateBorrower(
address userAddress
) external onlyManagerOrOwner nonReentrant whenNotPaused {
_update();
// Get the user's debt from the LendingPool.
uint256 userDebt = lendingPool.getUserDebt(userAddress); // user debt already scaled in the lending pool
// Use the scaled user debt directly without applying another scaling operation.
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

StabilityPool::liquidateBorrower double-scales debt by multiplying already-scaled userDebt with usage index again, causing liquidations to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.