Skip to content

Latest commit

 

History

History
82 lines (56 loc) · 2.86 KB

065.md

File metadata and controls

82 lines (56 loc) · 2.86 KB

Tiny Licorice Loris

Medium

Protocol can be made to lose out on liquidation fees all the time.

Summary

Users being liquidated can reduce their collateral balance to 0.. Whenever collateral Balance = 0. calculation for liquidation fee results in 0

https://github.com/sherlock-audit/2025-01-aave-v3-3/blob/main/aave-v3-origin/src/contracts/protocol/libraries/logic/LiquidationLogic.sol#L650-L679

Root Cause

Checking LiquidationLogic._calculateAvailableCollateralToLiquidate() which is used to calculate liquidationProtocolFee amongst other things.

 if (vars.maxCollateralToLiquidate > userCollateralBalance) {
      vars.collateralAmount = userCollateralBalance;
      vars.debtAmountNeeded = ((vars.collateralAssetPrice * vars.collateralAmount * debtAssetUnit) /
        (debtAssetPrice * collateralAssetUnit)).percentDiv(liquidationBonus);
    } else {
      vars.collateralAmount = vars.maxCollateralToLiquidate;
      vars.debtAmountNeeded = debtToCover;
    }

    vars.collateralToLiquidateInBaseCurrency =
      (vars.collateralAmount * vars.collateralAssetPrice) /
      collateralAssetUnit;

    if (vars.liquidationProtocolFeePercentage != 0) {
      vars.bonusCollateral =
        vars.collateralAmount -
        vars.collateralAmount.percentDiv(liquidationBonus);

      vars.liquidationProtocolFee = vars.bonusCollateral.percentMul(
        vars.liquidationProtocolFeePercentage
      );
      vars.collateralAmount -= vars.liquidationProtocolFee;
    }
    return (
      vars.collateralAmount,
      vars.debtAmountNeeded,
      vars.liquidationProtocolFee,
      vars.collateralToLiquidateInBaseCurrency
    );
  }

It is observed that if userCollateralBalance == 0 , the calculation for so many things of which liquidationProtocolFee is among will result in 0.

So whenever a user deliberately reduces his collateral to 0 especially when he knows that he is about to be liquidated, Protocol will lose out on liquidation fees.

Internal Pre-conditions

  1. calculation for liquidationProtocolFee relies on user-to-be-liquidated's collateral balance.

External Pre-conditions

  1. user reduces his collateral to 0 when his position is liquidatable

Attack Path

  1. User takes positions
  2. user's position turns unhealthy and becomes liquidatable
  3. user transfers out all his collateral balance reducing it to 0
  4. user's position is liquidated but protocol loses out on liquidation fees.

Impact

Protocol can be made to lose out on liquidation fees all the time.

PoC

No response

Mitigation

Use a locking system for user's collaterals.

That way in situations of liquidation, there's no risk that the user can deliberately reduce his collateral balance to 0.

Using a locking system for user's collateral will ensure that liquidator's will receive incentives most times and protocol won't be made to lose out on fees deliberately by malicious users