Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

`LendingPool::closeLiqduidation()` is incomplete

charlescheerful

Vulnerability Details

The function at LendingPool::closeLiquidation() is incomplete and allows anyone to avoid liquidations without repaying the debt.

The reason is very straightforward. The function does not call the _repay() function, which is the one that actually repays the debt. This means that anyone can call closeLiquidation() and avoid repaying the debt.

The function simply sets your isUnderLiquidation to false. The only worrying constrain is that your debt is not dust debt, but most of the cases won't. Effectively making any liquidatable user be able to save themselves without a cost.

There is also a grace period so users have enough time to save themselves if necessary, which only adds to how easy is for anyone to avoid liquidations.

See the function here:

function closeLiquidation() external nonReentrant whenNotPaused {
address userAddress = msg.sender;
​
if (!isUnderLiquidation[userAddress]) revert NotUnderLiquidation();
​
// update state
ReserveLibrary.updateReserveState(reserve, rateData);
@> // 👁️ Grace period check, minimum that can be set is 1 day, as per LendingPool::setParameter() logic
@> // 👁️ see setParameter() constrain here: https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/LendingPool/LendingPool.sol#L139
if (block.timestamp > liquidationStartTime[userAddress] + liquidationGracePeriod) {
revert GracePeriodExpired();
}
​
UserData storage user = userData[userAddress];
​
uint256 userDebt = user.scaledDebtBalance.rayMul(reserve.usageIndex);
@> // 👁️ DUST_THRESHOLD is only 1e6. Less than a 10th of a cent.
if (userDebt > DUST_THRESHOLD) revert DebtNotZero();
​
@> // 👁️ Users just becomes unliquidatable again
isUnderLiquidation[userAddress] = false;
liquidationStartTime[userAddress] = 0;
​
emit LiquidationClosed(userAddress);
}

Impact

Function is just wrong.

  • Users using it won't repay anything.

  • Anyone can cancel their liquidation without repaying, allowing for bad debt to exist and breaking the health of the system completely.

Recommendations

Add the _repay() execution flow to the closeLiquidation() function.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.