You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA Medium severity issue.RewardA payout will be made for this issue
The interest rate for the collateral asset is incorrectly calculated during liquidation
Summary
In the protocol, depositors can supply assets as collateral to the pool and earn interest from borrowers. Borrowers, in turn, can borrowassets and are required to pay interest.
It's essential that interest rates are correctly calculated for both debt and collateral.
However, during liquidation, the interest rates for the collateral asset are incorrectly calculated.
Additionally, the underlyingBalance of the collateral asset is tracked inaccurately.
Vulnerability Detail
When liquidity changes (such as during deposits, repayments, borrowing, or withdrawals), the interest rate adjusts.
Specifically, in line 158, totalDebt represents the current total debt of the asset reserve.
When liquidity increases (e.g., deposits or repayments), the _liquidityAdded value is positive (line 165).
Conversely, when liquidity decreases (e.g., borrowing or withdrawals), the _liquidityTaken value is positive (line 166).
These values are used to calculate new interest rates for both debt and collateral.
In lines 176 and 177, the underlyingBalance is updated based on changes in liquidity.
The liquidation process occurs in the executeLiquidationCall function.
In line 138, the _calculateAvailableCollateralToLiquidate function is called to determine how much collateral the liquidator and the protocol will receive.
The variable vars.actualCollateralToLiquidate represents the amount sent to the liquidator, while vars.liquidationProtocolFeeAmount is the protocol's fee.
The total amount removed from the collateral asset reserve should be the sum of these two values.
However, when updating the interest rates for the collateral asset, only vars.actualCollateralToLiquidate is considered in the _liquidityTaken value in line 222.
sherlock-admin3
changed the title
Smooth Carbon Narwhal - The interest rate for the collateral asset is incorrectly calculated during liquidation
ether_sky - The interest rate for the collateral asset is incorrectly calculated during liquidation
Oct 3, 2024
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA Medium severity issue.RewardA payout will be made for this issue
ether_sky
Medium
The interest rate for the collateral asset is incorrectly calculated during liquidation
Summary
In the protocol,
depositors
can supplyassets
ascollateral
to thepool
and earninterest
fromborrowers
.Borrowers
, in turn, canborrow
assets
and are required to payinterest
.It's essential that
interest rates
are correctly calculated for bothdebt
andcollateral
.However, during
liquidation
, theinterest rates
for thecollateral asset
are incorrectly calculated.Additionally, the
underlyingBalance
of thecollateral asset
is tracked inaccurately.Vulnerability Detail
When
liquidity
changes (such as duringdeposits
,repayments
,borrowing
, orwithdrawals
), theinterest rate
adjusts.Specifically, in
line 158
,totalDebt
represents the currenttotal debt
of theasset reserve
.When
liquidity
increases (e.g.,deposits
orrepayments
), the_liquidityAdded
value is positive (line 165
).Conversely, when
liquidity
decreases (e.g.,borrowing
orwithdrawals
), the_liquidityTaken
value is positive (line 166
).These values are used to calculate new
interest rates
for bothdebt
andcollateral
.In
lines 176
and177
, theunderlyingBalance
is updated based on changes inliquidity
.The
liquidation
process occurs in theexecuteLiquidationCall
function.In
line 138
, the_calculateAvailableCollateralToLiquidate
function is called to determine how muchcollateral
theliquidator
and theprotocol
will receive.The variable
vars.actualCollateralToLiquidate
represents the amount sent to theliquidator
, whilevars.liquidationProtocolFeeAmount
is theprotocol's fee
.The total amount removed from the
collateral asset reserve
should be the sum of these two values.However, when updating the interest rates for the
collateral asset
, onlyvars.actualCollateralToLiquidate
is considered in the_liquidityTaken
value inline 222
.As a result,
vars.liquidationProtocolFeeAmount
is excluded from theinterest rate
calculation.Impact
Interest rates
are a crucial component of the lending protocol.Additionally, due to this issue, the
underlyingBalance
can no longer be trusted.Code Snippet
https://github.com/sherlock-audit/2024-06-new-scope/blob/c8300e73f4d751796daad3dadbae4d11072b3d79/zerolend-one/contracts/core/pool/logic/ReserveLogic.sol#L158-L177
https://github.com/sherlock-audit/2024-06-new-scope/blob/c8300e73f4d751796daad3dadbae4d11072b3d79/zerolend-one/contracts/core/pool/logic/LiquidationLogic.sol#L138-L148
https://github.com/sherlock-audit/2024-06-new-scope/blob/c8300e73f4d751796daad3dadbae4d11072b3d79/zerolend-one/contracts/core/pool/logic/LiquidationLogic.sol#L222
Tool used
Manual Review
Recommendation
Ensure that
vars.liquidationProtocolFeeAmount
is also included in theinterest rate
calculation.Duplicate of #401
The text was updated successfully, but these errors were encountered: