Skip to content

Latest commit

 

History

History
44 lines (29 loc) · 2.39 KB

048.md

File metadata and controls

44 lines (29 loc) · 2.39 KB

Obedient Lava Monkey

Medium

Health Factor recalculation delay allows liquidators to over-liquidate users.

Summary

The delayed health factor recalculation in executeLiquidationCall allows liquidators to over-liquidate users, especially in scenarios involving multiple liquidations in a single block or gas-efficient batching systems.

Root Cause

In LiquidationLogic.sol (within executeLiquidationCall), the user's health factor is not recalculated after each liquidation. As a result, if multiple liquidators act on the same user in rapid succession (e.g., during a high-stress market event), the user’s position can be over-liquidated. _burnCollateralATokens _burnDebtTokens

Internal Pre-conditions

  1. A user's health factor is initially below 1, making them eligible for liquidation.
  2. Multiple liquidators submit liquidation transactions within the same block or immediately after one another.
  3. The user has sufficient collateral for over-liquidation.

External Pre-conditions

None (assumes the protocol is under high market activity or stress).

Attack Path

  1. A user’s position becomes liquidatable (health factor < 1).
  2. Liquidator A submits a transaction to liquidate part of the user's debt.
  3. Before the transaction is mined and the user's health factor is updated, Liquidator B also submits a liquidation transaction, assuming the original health factor.
  4. Both transactions succeed, resulting in the user’s position being over-liquidated.

Impact

The protocol allows over-liquidation of user positions, potentially reducing the collateral left for the user and transferring excess collateral to liquidators. This damages user trust and exposes the protocol to legal or reputational risks.

Mitigation

Recalculate and enforce the health factor after each liquidation to ensure no additional liquidations occur once the health factor recovers above the threshold.