bad debt is not socialized

Lines of code Vulnerability details Proof of Concept In case if borrower's position is unhealthy, then he can be liquidated. Liquidator can provide amount of shares in poolToRepay that he will cover and expects to get back poolOut shares. It is possible that position created a bad debt. This mean...

Position cannot be liquidated if the borrower is blocklisted

Lines of code Vulnerability details Impact position cannot be liquidated if the borrower is blocklisted Proof of Concept When the position is closed, the function closePosition is called // execute actual position closing closePositionparams, cache, lien, msg.sender; in this case, the msg.sender ...

Should count pending harvest reward and already harvested reward as collateral credit if the collateral is WLP

Lines of code Vulnerability details Impact Should count pending harvest reward and already harvested reward as collateral credit if the collateral is WLP Proof of Concept User can use WLP as collateral, even use WLP purely as collateral to borrow fund from lending pool the collateral worth of WLP...

Liquidation is not possible if trader blacklisted from blacklistable ERC20 token

Lines of code Vulnerability details Impact If a trader is blacklisted from a blacklistable ERC20 token while has an open position, it may not be possible to liquidate the position. Proof of Concept When liquidate position, it will eventually calculate the amount of token that need to be send to...

Users can't repay their debts if the OmniPool contract is paused which can cause users to fall into liquidation and lose their collateral

Lines of code Vulnerability details Impact Users can't repay their debts if the OmniPool contract is paused which can cause users to fall into liquidation and lose their collateral Proof of Concept The OmniPool::repay function has implemented the whenNotPaused modifier, which will prevent the...

After the market configuration expires or when borrow value greater than deposit value, there is no cap for liquidation seize amount

Lines of code Vulnerability details = Impact After the market configuration expires, there is no cap for liquidation seize amount Proof of Concept After the market configuration expires or when borrow value greater than deposit value, there is no cap for liquidation seize amount when liquidation ...

MEV bot can frontrun user's repayment to liquidate user first when the OmniPool is unpaused

Lines of code Vulnerability details Impact MEV bot can frontrun user's repayment to liquidate user first when the OmniPool is unpaused Proof of Concept this report tries to combine a few issue 1. when OmniPool is paused, interest is still accuring 2. when OmniPool is paused, user cannot repay 3...

Manipulation of NFV can trick it's buyer to have it on unexpected condition.

Lines of code Vulnerability details Impact NFV can be sold at a price not expected by the user or may be susceptible to liquidation shortly after buying it. Proof of Concept openSAFE function in ODSafeManager is supposed to be called by the ODProxy and mints nft for it, furthermore it calls...

Potential insolvency risk in dpxETH stablecoin system due to absence of liquidation mechanism

Lines of code Vulnerability details Impact The dpxETH stablecoin system, as implemented, relies on user deposits as collateral when the stablecoin is minted through bond purchasing. When the bonding process is done, the protocol mints a corresponding amount of Receipt tokens to the user that he c...

Vault will stop participating in draws in case if they deposited maximum assets to the underlying vault

Lines of code Vulnerability details Impact Vault will stop participating in draws in case if they deposited maximum assets to the underlying vault. Proof of Concept Vault contract has maxMint function. This function first checks allowed amount to mint in the PtVault and then also checks amount...

VaultBooster liquidations can revert due to discrepancy in liquidatable balance value

Lines of code Vulnerability details Impact When a user/bot wants to perform a liquidation for a liquidation pair, they can call view methods like maxAmountOut to see what balance of the output token they are able to liquidate at the current time. This makes an underlying call to...

swapExactAmountOut() does not have deadline which allows pending transactions to be maliciously executed

Lines of code Vulnerability details Impact In LiquidationRouter.sol, swapExactAmountOut function has no deadline for the transaction when swapping. File: src/LiquidationRouter.sol function swapExactAmountOut LiquidationPair liquidationPair, address receiver, uint256 amountOut, uint256 amountInMax...

_computeAvailable() the calculations are wrong

Lines of code Vulnerability details Impact computeAvailable incorrect calculations that result in a return value greater than the current balance, causing methods such as liquidate to fail Proof of Concept VaultBooster.computeAvailable used to count the number of tokens currently available There...

Incorrect parameter for getCallerReward might return 0 reward despite insolvency

Lines of code Vulnerability details Impact The calculation of the caller reward uses an incorrect value. If the exchangeRate remains the same but a lot of interest accrues, then there will be no liquidation reward. Without a liquidation reward borrowing positions will not get liquidated and incur...

The amount of debt removed during liquidation may be worth more than the account's collateral

Lines of code Vulnerability details Impact The contract decreases user's debts but may not take the full worth in collateral from the user, leading to the contract losing potential funds from the missing collateral. Proof of concept During the liquidate function call, the function...

liquidateBorrow() mTokens that do not enter the market can still be liquidated as collateral

Lines of code Vulnerability details Impact borrower's mTokens that do not join the market, but it still be Liquidation as collateral Proof of Concept If user wants to use mToken as collateral, the user needs to enter market with enterMarket function. / @notice Add assets to be included in account...

Current setUnderlyingPrice and setDirectPrice open to incorrect liquidation of users' positions and result in financial losses for users

Lines of code Vulnerability details Impact Price feeds can be affected by network congestion, causing transactions with outdated prices to be treated as current prices. As price feeds are crucial to the protocol's functioning, this situation can lead to incorrect liquidation of users' positions a...

More collateral is seized than approved

Lines of code Vulnerability details Impact More collateral is seized outside of the comptroller's approved liquidation amount which means excess seizeTokens are transferred from the borrower to the liquidator leading to loss of funds Proof of Concept liquidateBorrowFresh first checks the allowanc...

Users positions can be directly liquidated when the admin changes the collateralFactorMantissa from a higher value to a lower value

Lines of code Vulnerability details Impact In Comptroller contract : Market.collateralFactorMantissa mltiplier represents the maximum underlying asset amount the depositors can borrow against their collateral in a market,for example:if it is set to 0.9;then 90% of collateral value is allowed to b...

Users with bad collateralization ratio from either rebase/nonrebasevault can bypassliquidation

Lines of code Vulnerability details Impact users with an unsafe collateralization ratio who are supposed to be liquidated can manipulate the rigidRedemption feature to bypass the liquidation. From the code above its noted that being a rigidRedemption provider one can can put their collateral amou...