018.md

Obedient Lava Monkey

Medium

Incorrect handling of useATokens during repayment leads to loss of collateral.

Summary:

The failure to validate useATokens repayment mode when a user has insufficient aTokens balance will cause a partial repayment or unintended debt clearing for the user as the burn function fails or creates collateral inconsistencies.

---

Root Cause:

In BorrowLogic.sol, when params.useATokens is true, the repayment amount (params.amount) defaults to the caller’s aTokens balance, but there is no validation to ensure the balance is sufficient for the desired repayment.

---

Internal Pre-conditions:

1. User has an active debt position and collateral provided in aTokens.
2. User calls executeRepay with useATokens = true, but their aTokens balance is less than params.amount.

---

External Pre-conditions:

1. No manipulation of external reserves or dependencies is required.
2. Users are actively using aTokens as collateral.

---

Attack Path:

1. A user has an active borrow position and partially redeemed their aTokens (e.g., borrowed 100 units but holds only 50 aTokens).
2. The user calls executeRepay with useATokens = true and sets params.amount to a value exceeding their available aTokens balance (e.g., 100 units).
3. The repayment process attempts to burn aTokens (via IAToken.burn), leading to incomplete repayment or a revert.
4. If incomplete repayment occurs, the user’s remaining collateral is mismanaged, leaving the system with improper debt and collateral accounting.

---

Impact:

Users may lose their remaining collateral (aTokens) without fully repaying their debt, or the protocol may encounter collateral-debt inconsistencies. This creates systemic risks and potential user losses. Impact depends on the extent of the user's position but could lead to insolvency in edge cases.

---

Mitigation:

Add a validation step in executeRepay to ensure the caller’s aTokens balance is at least equal to params.amount when useATokens = true.