Skip to content

Latest commit

 

History

History
51 lines (34 loc) · 2.38 KB

086.md

File metadata and controls

51 lines (34 loc) · 2.38 KB

Obedient Lava Monkey

Medium

Incorrect LTV validation in validateHFAndLtv will cause improper collateral assessment for users, leading to invalid rejections

Summary

The reliance on zero-LTV collateral checks in validateHFAndLtv will cause unintended rejections of valid user actions for users when collateral assets with non-zero LTV are incorrectly flagged due to a mismatch in collateral and reserve configuration.

Root Cause

In ValidationLogic.sol, the validateHFAndLtv function assumes that collateral with zero LTV (Loan-to-Value) cannot coexist with reserves having non-zero LTV configurations. Specifically, the check:

require(
    !hasZeroLtvCollateral || reserve.configuration.getLtv() == 0,
    Errors.LTV_VALIDATION_FAILED
);

fails to account for cases where users may hold valid non-zero LTV reserves alongside zero-LTV assets. This causes actions like borrowing or withdrawing to be incorrectly flagged as invalid if any collateral in the user's portfolio has a zero LTV, rather than evaluating the portfolio as a whole.

Internal Pre-conditions

  1. A reserve with non-zero LTV exists in the system.
  2. A user holds collateral marked as zero-LTV due to specific configuration but attempts an action requiring reserve LTV validation.

External Pre-conditions

  1. The oracle must report correct prices for the user’s collateral and debt assets.
  2. Protocol configurations do not disable zero-LTV reserves by design.

Attack Path

  1. A user supplies collateral with a non-zero LTV reserve but with zero-LTV configuration on the user side.
  2. The protocol incorrectly flags the user's position as invalid due to the validateHFAndLtv zero-LTV check.
  3. Actions such as borrowing, withdrawing, or repaying are incorrectly rejected.

Impact

Users cannot borrow or use their collateral properly despite meeting all other reserve requirements, leading to unnecessary.

Mitigation

Refactor validateHFAndLtv to ensure that zero-LTV collateral is only flagged if all reserves in the user’s portfolio are zero-LTV, and actions dependent on LTV are explicitly checked against valid reserves.