totalBorrows is not deducted properly when Comptroller#healAccount is called

Lines of code Vulnerability details Impact TotalBorrowed in VToken is not accounted properly when healAccount is called. Proof of Concept ComptrollerhealAccount intends to forgive the debt of the account if the debt goes far too underwater. When that happens, the collateral is seized, some of the...

Comptroller.sol#healAccount did not call updateRewardTokenBorrowIndex to update the reward

Lines of code Vulnerability details Impact healAccount should call updateRewardTokenBorrowIndex to calculate the reward before affecting the debt value. Proof of Concept Tools Used manual Recommended Mitigation Steps call updateRewardTokenBorrowIndex before heal account. Assessed type Other --- T...