You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA Medium severity issue.RewardA payout will be made for this issue
Liquidation protocol fee is not considered when calculating interest rates after liquidations
Summary
When a liquidation occurs and interest rates of the collateral reserve are updated, the calculation of the new interest rates does not consider that liquidation protocol fees will also be withdrawn. This causes the collateral reserve interest rates to be higher than intended.
Root Cause
In _burnCollateralTokens when updateInterestRates is called, the value for the _liquidityTaken parameter is set to vars.actualCollateralToLiquidate. This is an issue as it does not include the value of the liquidation protocol fee, transferred to the treasury.
Those fees also need to be a part of _liquidityTaken as IReserveInterestRateStrategy(_reserve.interestRateStrategyAddress).calculateInterestRates will calculate the new interest rate based on the pool's balance of the asset. As the fee transfer is performed after the rates are updated, the asset balance of the pool will be incorrectly inflated by the value of the fees, causing calculateInterestRates to return a higher value and interest rates to be higher than intended.
Internal pre-conditions
liquidationProtocolFeePercentage must be more than 0.
External pre-conditions
No response
Attack Path
A liquidation occurs with actualCollateralToLiquidate equal to 10 ETH and liquidationProtocolFeeAmount equal to 1 ETH.
In order to calculate what the collateral reserve interest rates should be, updateInterestRates is called in _burnCollateralTokens. There the pool's balance of the asset is inflated by 1 ETH of liquidation fees which are going to be transferred from the pool to the treasury after _burnCollateralTokens has been fully executed.
Interest rates are wrongly calculated and are more than intended as _liquidityTaken does not include the 1 ETH of liquidation fees.
Impact
As a result, when a liquidation occurs interest rates will be higher than what the protocol intends.
PoC
No response
Mitigation
In _burnCollateralTokens when updateInterestRates is called, the value for the _liquidityTaken parameter should be set to vars.actualCollateralToLiquidate + the number of liquidation fees.
sherlock-admin3
changed the title
Curly Pineapple Armadillo - Liquidation protocol fee is not considered when calculating interest rates after liquidations
trachev - Liquidation protocol fee is not considered when calculating interest rates after liquidations
Oct 3, 2024
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA Medium severity issue.RewardA payout will be made for this issue
trachev
Medium
Liquidation protocol fee is not considered when calculating interest rates after liquidations
Summary
When a liquidation occurs and interest rates of the collateral reserve are updated, the calculation of the new interest rates does not consider that liquidation protocol fees will also be withdrawn. This causes the collateral reserve interest rates to be higher than intended.
Root Cause
In
_burnCollateralTokens
whenupdateInterestRates
is called, the value for the_liquidityTaken
parameter is set tovars.actualCollateralToLiquidate
. This is an issue as it does not include the value of the liquidation protocol fee, transferred to the treasury.Those fees also need to be a part of
_liquidityTaken
asIReserveInterestRateStrategy(_reserve.interestRateStrategyAddress).calculateInterestRates
will calculate the new interest rate based on the pool's balance of the asset. As the fee transfer is performed after the rates are updated, the asset balance of the pool will be incorrectly inflated by the value of the fees, causingcalculateInterestRates
to return a higher value and interest rates to be higher than intended.Internal pre-conditions
liquidationProtocolFeePercentage
must be more than 0.External pre-conditions
No response
Attack Path
actualCollateralToLiquidate
equal to 10 ETH andliquidationProtocolFeeAmount
equal to 1 ETH.updateInterestRates
is called in_burnCollateralTokens
. There the pool's balance of the asset is inflated by 1 ETH of liquidation fees which are going to be transferred from the pool to the treasury after_burnCollateralTokens
has been fully executed._liquidityTaken
does not include the 1 ETH of liquidation fees.Impact
As a result, when a liquidation occurs interest rates will be higher than what the protocol intends.
PoC
No response
Mitigation
In
_burnCollateralTokens
whenupdateInterestRates
is called, the value for the_liquidityTaken
parameter should be set tovars.actualCollateralToLiquidate
+ the number of liquidation fees.Duplicate of #401
The text was updated successfully, but these errors were encountered: