Stratax Contracts
First Flight #57
Beginner FriendlyDeFi
100 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: high

_executeOpenOperation::require(healthFactor > 1e18 ) can lead to unsafe leverage position

Author Revealed upon completion

_executeOpenOperation::require(healthFactor > 1e18 ) can lead to unsafe leverage positionDescription

  • When creating a leveraged position, by taking out the flash loan, the contract checks if the leveraged position is safe. This is done to avoid liquidation as a result of price movements in the market.

  • Howver, the protocol only checks if leverage is greater than 1e18 which passes the protocol check but may actually be unsafe. The leveraged position may pass the check but still be unsafe

// Root cause in the codebase with @> marks to highlight the relevant section
​
function _executeOpenOperation(
address _asset,
uint256 _amount,
uint256 _premium,
bytes calldata _params
) internal returns (bool) {
// // // .................
​
// Step 5: Check health factor of user's position
(, , , , , uint256 healthFactor) = aavePool.getUserAccountData(
address(this)
);
@> require(healthFactor > 1e18, "Position health factor too low");
​
// Supply any leftover tokens back to Aave to improve position health
if (returnAmount - totalDebt > 0) {
IERC20(_asset).approve(address(aavePool), returnAmount - totalDebt);
aavePool.supply(_asset, returnAmount - totalDebt, address(this), 0);
}
​
IERC20(_asset).approve(address(aavePool), totalDebt);
​
emit LeveragePositionCreated(
user,
_asset,
flashParams.borrowToken,
totalCollateral,
flashParams.borrowAmount,
healthFactor
);
​
return true;
}

Risk

Likelihood:

  • This will occur when the protocol creates a leveraged position with a very high borrow amount. The position may be technically safe but risky


Impact:

  • This can lead to the liquidation of leveraged position as a result of price movements in the market.

  • It violates the protocol's economic design

Proof of Concept

​

Recommended Mitigation

This vulnerability can be mitigated by setting a minimum healthy position

+ require(healthFactor > MINIMUM_HEALTH_POSITION, "Position health factor too low");

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!