Skip to content

Latest commit

 

History

History
43 lines (28 loc) · 2.04 KB

045.md

File metadata and controls

43 lines (28 loc) · 2.04 KB

Obedient Lava Monkey

Medium

Unrestricted transfer of aTokens during liquidation can bypass isolation mode restrictions.

Summary

The unrestricted transfer of aTokens in _liquidateATokens will cause isolation mode restrictions to be bypassed for the liquidator as the transferOnLiquidation function does not enforce isolation mode constraints, allowing the liquidator to hold isolated aTokens and potentially over-leverage their position.

Root Cause

In LiquidationLogic.sol (within _liquidateATokens), the transferOnLiquidation function transfers aTokens to the liquidator without verifying isolation mode constraints on the liquidator's configuration. Isolation mode limits are only checked when using tokens as collateral but are not enforced during liquidation transfers.

Internal Pre-conditions

  1. A reserve is marked as isolated in its configuration.
  2. A user holds aTokens in isolation mode and gets liquidated.
  3. The liquidator has a position that could violate isolation mode constraints upon receiving the aTokens.

External Pre-conditions

None (assumes trusted dependencies).

Attack Path

  1. A user gets liquidated while holding aTokens from an isolated reserve.
  2. The liquidator receives the isolated aTokens via transferOnLiquidation.
  3. The protocol does not verify isolation mode constraints on the liquidator's position during the transfer.
  4. The liquidator uses the isolated aTokens as collateral, bypassing isolation mode limits and potentially over-leveraging their position.

Impact

Liquidators could over-leverage positions, increasing the likelihood of cascading liquidations and insolvency in edge cases.

Mitigation

Before enabling the liquidator's aTokens as collateral, enforce isolation mode constraints by checking the liquidator's updated configuration after receiving the aTokens.