Skip to content

Latest commit

 

History

History
71 lines (44 loc) · 1.84 KB

100.md

File metadata and controls

71 lines (44 loc) · 1.84 KB

Quaint Cyan Porcupine

High

Liquidator can repay dust debt to fully liquidate user

Summary

With new changes in Aave V3, if user's position is underwater, he can be liquidated for 100% of his debt if any of these conditions are met:

  • User's total collateral value is less than MIN_THRESHOLD
  • User's total debt value is less than MIN_THRESHOLD
  • User's health factor is less than 0.95

https://github.com/sherlock-audit/2025-01-aave-v3-3/blob/main/aave-v3-origin/src/contracts/protocol/libraries/logic/LiquidationLogic.sol#L284

If we look closely, we find 2nd point can be manipulated by anyone as Aave enables repaying loan on someone's behalf. This creates unintended incentive for a liquidator to check if it is possible to repay some debt of this position and then liquidate full debt of this position and thus earning higher profit.

Let's look at an example:

Initial Position

Total Collateral Value: 2420 Total Debt Value: 2050 LTV: 82.5 Health Ratio: 0.973

This position if liquidated: Debt repaid = 1025 Collateral seized(Penalty as 15%) = 1178.75 Profit = 1178.75 - 1025 = 153.75

Liquidator repays $51 worth of user's debt

Total Collateral Value: 2420 Total Debt Value: 1999 LTV: 82.5 Health Ratio: 0.9987

This position is liquidated: Debt repaid = 1999 Collateral seized(Penalty as 15%) = 2298.85 Profit = 2298.85 - 1999 - 51 = 248.85

This caused a loss of 248.85-153.75 = $95 to end user, which is enough incentive for a liquidator to repay some portion to extract out more profit.

Root Cause

No response

Internal Pre-conditions

No response

External Pre-conditions

No response

Attack Path

No response

Impact

No response

PoC

No response

Mitigation

If someone else is repaying loan on user's behalf, add a check that remaining debt is not less than MIN_THRESHOLD. This should prevent any such case.