You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA Medium severity issue.RewardA payout will be made for this issue
sherlock-admin3
changed the title
Decent Walnut Squirrel - The protocol updates interest rates of collateral wrongly when liquidation.
dany.armstrong90 - The protocol updates interest rates of collateral wrongly when liquidation.
Oct 3, 2024
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA Medium severity issue.RewardA payout will be made for this issue
dany.armstrong90
High
The protocol updates interest rates of collateral wrongly when liquidation.
Summary
The protocol does not consider
liquidationProtocolFee
which transfers to treasury when update interest rates of collateral.Vulnerability Detail
LiquidationLogic.sol#executeLiquidationCall()
is as follows.As we can see above, on L188 it transfers
liquidationProtocolFee
to treasury.And
_burnCollateralTokens()
function called on L174 is as follows.As we can see above, the protocol does not consider
liquidationProtocolFeeAmount
to transfers to treasury.So
interestRates
is updated wrongly.Impact
When liquidation, the protocol updates interestRates wrongly, so protocol
interestRates
and indexes can be corrupted by liquidation as time goes by.Code Snippet
https://github.com/sherlock-audit/2024-06-new-scope/blob/main/zerolend-one/contracts/core/pool/logic/LiquidationLogic.sol#L222
Tool used
Manual Review
Recommendation
The
_burnCollateralTokens()
function has to be modified as follows.Duplicate of #401
The text was updated successfully, but these errors were encountered: