borrowingVault: owner and receiver of `gainedShares` addresses in liquidate function

Title

A user who has the LIQUIDATOR_ROLE will not lose their gainedShares even if their debt would be liquidated

Affected smart contract

Description

Within the BorrowingVault# liquidate(), the owner of debt and the receiver who is a liquidator would be assigned as parameters. Once liquidation occur, the gainedShares will be burned from the owner and the gainedShares will be minted to the receiver like this: https://github.com/Fujicracy/fuji-v2/blob/main/packages/protocol/src/vaults/borrowing/BorrowingVault.sol#L585-L586 https://github.com/Fujicracy/fuji-v2/blob/main/packages/protocol/src/vaults/borrowing/BorrowingVault.sol#L622-L623

  function liquidate(
    address owner,  /// @audit
    address receiver  /// @audit
  )
    external
    hasRole(msg.sender, LIQUIDATOR_ROLE)
    returns (uint256 gainedShares)
  {
    ...

    // Internal share adjusment between 'owner' and 'liquidator'.
    _burn(owner, gainedShares);  /// @audit
    _mint(receiver, gainedShares);  /// @audit

    ...
}

In the case above, a user who has the LIQUIDATOR_ROLE can assign both the owner and the receiver as argument value when the user call the BorrowingVault# liquidate().

The owner and the receiver are supposed to be different address. Because if the same address would be assigned into the both owner and receiver, the gainedShares can be minted to the receiver even if the gainedShares would be burned from the owner.

However, there is no validation to check whether the owner and receiver are different address. If a user who has the LIQUIDATOR_ROLE assign the same address with the owner into the receiver as argument value when the user call the BorrowingVault# liquidate(), the address assigned will not lose their gainedShares even if the owner is liquidated.

Attack scenario

A user who has the LIQUIDATOR_ROLE borrow some amount of tokens based on shares and the user become the owner of the debt.
Once liquidationFactor meet the threshold of liquidation, the debt of the owner will be liquidated.
The user who has the LIQUIDATOR_ROLE call the BorrowingVault# liquidate() by assigning the same address with owner into the receiver.
Once the BorrowingVault# liquidate() is called above, the amount of gainedShares would be burned from the owner then the same amount of the gainedShares would be minted to the receiver.
Assuming that the same address with owner was assigned into the receiver, the owner will not lose their gainedShares. Because the receiver receive the amount of gainedShares burned from the owner.

Recommendation

Consider adding a validation in order to check whether the owner and receiver are different address to the BorrowingVault# liquidate() like this:

  function liquidate(
    address owner,  /// @audit
    address receiver  /// @audit
  )
    /// @audit - Consider adding a validation like this:
+   require(owner != receiver, "Owner and receiver must be different address");
    ...

    // Internal share adjusment between 'owner' and 'liquidator'.
    _burn(owner, gainedShares); 
    _mint(receiver, gainedShares);

    ...
}

Fujicracy / fuji-v2