Skip to content

Latest commit

 

History

History
43 lines (25 loc) · 2.1 KB

068.md

File metadata and controls

43 lines (25 loc) · 2.1 KB

Calm Pine Robin

High

bad debts are not written off

Summary

when a borrow position is liquidated it is possible for the full or most of the collateral to be seized while the borrow balance is still not written off. when users call liquidate to liquidate a borrow position they can choose to repay whatever amount they want to for normal liquidations or bad debt liquidations this can lead to a scenario where the borrowers borrow amount is still in the contract accruing interest while there is no real backing for the inflated exchange rate which is increased as total borrows or interest on borrows is accumulated this will cause a virtual balance to buildup with no sufficient backing leading to insolvency of the protocol in the long term

Root Cause

https://github.com/sherlock-audit/2024-12-numa-audit/blob/main/Numa/contracts/NumaProtocol/NumaVault.sol#L1113-L1229

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

inflated borrowamount with no real backing will cause the exchange rate to be inflated this bad debt will accrue interest which is then added to total borrows which is used to calculate the exchange rate

PoC

protocol allows partial liquidations and liquidators can specify the amount they want to liquidate which will lead to a following situation

  1. alice has a debt position of 1000 reth and 1100 collateral
  2. overtime her positions accrues interest and her debt is 1200 at 1100 collateral with no sufficient backing
  3. a liquidator liquidates her position partially leaving some borrow balance and very little collateral now her position is not profitable to liquidate the gas cost to liquidate her full remaining borrow balance or collateral isnt profitable for liquidators
  4. her remaining borrow stays in the contract and accrues interest over time this will cause the exchange rate to be inflated with no real backing overtime leading to insolvency for the protocol
  5. another thing that contributed to this high likelhood of leaving some debts is seize tokens always rounds up

Mitigation

clear the bad debt