Core Contracts

Summary

Liquidation can still take place when the contract is paused but not with repayment, this is very unfair for the borrower.

Vulnerability Details

All liquidation related functions have whenNotPaused modifier which means the function can only be called when the contract is not paused. But the finalizeLiquidation() function does not have that modifier so liquidation can still take place even though the lending pool contract is paused.

This is unfair to the borrower because they can be liquidated when the contract is paused or after the contract is unpaused without the opportunity to pay the debt and be free from liquidation.

as an example :

1. Bob call initialLiquidation() and set Alice to be liquidated before the Lending Pool contract is paused

2. The Lending Pool contract is paused for 3 days and the grace period has a duration of 1 day

3. On the second day or after 3 days, the liquidateBorrower() function is called on the StabilityPool to liquidate Alice

4. This will end with Alice being liquidated without any chance to pay her debt.

Impact

Borrower being liquidated without any chance to pay the debt

Tools Used

Manual Review

Recommended Mitigation

Consider allow repayment even Lending Pool in paused state