Core Contracts

Summary

The current liquidation mechanism in the LendingPool.sol allows a borrower's health factor to drop below the liquidation threshold before initiating liquidation. This delay can result in bad debt if the collateral price drops drastically before liquidation occurs.

Vulnerability Details

The protocol relies on a health factor to determine when to liquidate borrowers in the initiateLiquidation Function. However, the current implementation allows a borrower's health factor to drop below the liquidation threshold before triggering liquidation. This delay creates a risk of bad debt if collateral prices drop too quickly.

📜 Affected Code

📌 Issue: Liquidation only happens after healthFactor falls below the threshold, potentially too late.

Bug Senerio

1. User takes a loan by depositing collateral and borrowing tokens.

2. The collateral price drops suddenly due to market fluctuations or manipulation.

3. The health factor falls below 1.0, meaning the collateral is now worth less than the debt.

4. The protocol tries to liquidate, but the collateral is already insufficient.

5. Protocol takes a loss because it cannot recover the full loan amount.

Impact

• If the price of collateral drops quickly, the liquidation process is too slow to react.

• The protocol might not recover enough funds, leading to bad debt and insolvency risks.

• Attackers could manipulate prices to exploit this flaw.

Tools Used

Manuel Review

Recommendations

1. Trigger Liquidation Earlier

• Instead of waiting for healthFactor < 1.0, trigger liquidation when healthFactor < 1.1.

2. Implement Emergency Liquidation

• If the price of collateral drops drastically, force liquidation immediately before it falls too low.

3. Use Automated Liquidation Bots

• Set up off-chain keepers (or Chainlink Automation) to detect sudden price drops and trigger liquidations instantly.

  Suggested Fix (Code Improvement)

  uint256 emergencyThreshold = healthFactorLiquidationThreshold.percentMul(90_00); // 90% of threshold

  ​

  if (collateralValue < userDebt.percentMul(emergencyThreshold)) {

  // Force liquidation immediately to prevent protocol loss

  forceLiquidate(userAddress);

  }