Formal Pecan Mongoose
Medium
The NumaComptroller contract assumes that a user can only interact with two tokens—one collateral token and one borrow token. This assumption is embedded in several functions responsible for calculating account liquidity and loan-to-value ratios. As a result, the contract fails to correctly handle scenarios where users interact with multiple tokens, leading to inaccurate liquidity assessments and potential security risks.
https://github.com/sherlock-audit/2024-12-numa-audit/blob/main/Numa/contracts/lending/NumaComptroller.sol#L1220C4-L1246C10 https://github.com/sherlock-audit/2024-12-numa-audit/blob/main/Numa/contracts/lending/NumaComptroller.sol#L892C5-L1012C6
These are the affected functions getAccountLiquidityIsolateInternal, getHypotheticalAccountLiquidityIsolateInternal and getAccountLTVIsolateInternal These functions only consider two tokens when calculating liquidity:
One collateral token One borrow token
The functions are designed with the assumption that users will only have positions in two tokens. The iteration over accountAssets retrieves only one other token, ignoring any additional assets.
No response
No response
The functions fail to iterate over all assets in accountAssets[account].
By only considering up to two tokens, the contract overlooks additional collateral or debt positions a user may have. Overestimation of Liquidity, If additional collateral is present but not considered. Underestimation of Risk, If additional borrowed assets are present but not accounted for.
User's Positions: Supplies collateral in Token A and Token B. Borrows Token C and Token D.
Contract's Calculation: Only considers Token A as collateral and Token C as debt. Ignores Token B and Token D entirely.
If a user supplies collateral in multiple markets or has borrowed from multiple markets, these functions will not account for all their positions. The contract may incorrectly calculate a user's liquidity, leading to wrong conclusions about their borrowing capacity or liquidation thresholds. Users might be unfairly liquidated due to underreported collateral. Users may be prevented from borrowing even if they have sufficient collateral.
No response
Consider all supplied and borrowed assets in the user's portfolio. Accurately sum up collateral values and outstanding debts.