Skip to content

Latest commit

 

History

History
42 lines (27 loc) · 2.2 KB

044.md

File metadata and controls

42 lines (27 loc) · 2.2 KB

Obedient Lava Monkey

Medium

Incorrect handling of bad debt with zero collateral positions can cause an infinite deficit increase.

Summary

The lack of a condition to check whether a reserve's deficit has already been updated for bad debt will cause repeated additions to the deficit in _burnDebtTokens, leading to a continually growing deficit for zero-collateral positions during multiple calls to liquidation or debt-cleanup functions.

Root Cause

In LiquidationLogic.sol (within _burnDebtTokens), the protocol assumes that outstandingDebt after liquidation should always be added to deficit. However, if hasNoCollateralLeftis true and the reserve already contains the bad debt from previous calls, the deficit will be incremented repeatedly without bounds.

Internal Pre-conditions

  1. The user has no collateral left (hasNoCollateralLeft == true).
  2. outstandingDebt != 0 (e.g., from accrued interest or partial liquidation).
  3. The function _burnDebtTokens is called multiple times for the same reserve and user.

External Pre-conditions

None (assumes trusted dependencies).

Attack Path

  1. A user becomes undercollateralized or leaves bad debt after liquidation.
  2. The deficit for the reserve is updated in _burnDebtTokens during the first call.
  3. The same user’s bad debt triggers multiple liquidation or debt cleanup calls, and the deficit is incremented each time without checking if it already includes the user's outstanding debt.

Impact

The protocol suffers an unbounded inflation of the reserve’s deficit, making it impossible to accurately track the actual bad debt. This could mislead governance and treasury operations, ultimately damaging the protocol's financial integrity.

Mitigation

Add a check to ensure that the user's outstanding debt is only added to the reserve's deficit once.