Core Contracts

Summary

The initiateLiquidation function is publicly accessible, allowing any external user to trigger the liquidation process for any account. This poses a significant security risk as unauthorized parties can exploit this functionality, potentially leading to malicious liquidations.

Vulnerability Details

2025-02-raac/contracts/core/pools/LendingPool/LendingPool.sol at main · Cyfrin/2025-02-raac

• No Access control: The function is marked as external, making it callable by any address. There are no access control mechanisms like onlyOwner or onlyStabilityPool modifiers to restrict its usage.

• Missing Validation: The absence of role-based access control permits unauthorized initiations of liquidations.

Impact

Tools Used

Recommendations

Implement Access Control: Add onlyOwner or onlyStabilityPool modifiers to restrict the function's access to authorized roles only.