Increasing collateral and decreasing it's liquidation price, such that with new liquidation price and old collateral position is becoming unsound, leads to a revert.
Such situation can happen often, imagine position that's fully minted and has market price of collateral close to liquidation, in this case, to keep position from liquidation, owner will add collateral and decrease liquidation price. Since it's fully minted, any decrease in liquidation price will lead to revert.
Lines of code
https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Position.sol#L132
Vulnerability details
Impact
Increasing collateral and decreasing it's liquidation price, such that with new liquidation price and old collateral position is becoming unsound, leads to a revert. Such situation can happen often, imagine position that's fully minted and has market price of collateral close to liquidation, in this case, to keep position from liquidation, owner will add collateral and decrease liquidation price. Since it's fully minted, any decrease in liquidation price will lead to revert.
Proof of Concept
calling adjust with
newPrice < price
andnewCollateral > collateralBalance()
will lead to these consecutive calls https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Position.sol#L134 https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Position.sol#L163 https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Position.sol#L283 and could revert, sincecollateralReserve
equals toCollateralBalance()
, which wasn't updated yet https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Position.sol#L138Recommended Mitigation Steps
Place
if (newPrice != price)
clause afterif (newMinted < minted)