Not able to make position healthy when stETH collateral is paused
Proof of Concept
In BorrowOperation, the user and protocol relies on this function to move the collateral from the user to activePool
function _activePoolAddColl(uint256 _stEthBalance, uint256 _sharesToTrack) internal {
// NOTE: No need for safe transfer if the collateral asset is standard. Make sure this is the case!
collateral.transferFrom(msg.sender, address(activePool), _stEthBalance);
activePool.increaseSystemCollShares(_sharesToTrack);
}
the user replies this funciton to add more collateral to make account healthy
the admin on stETh can pause the contract to block collateral transfer
in this case, the interest still accuring while the user cannot make account more healthy by adding more collateral
in case when the stETH price drops, the user has no option, their position is subject to liquidation
Tools Used
Manual Review
Recommended Mitigation Steps
make sure interest is not accuring when the collateral token transfer is paused, and detect when the stETH unpause, leave sufficient time for user to add more collateral
Lines of code
https://github.com/code-423n4/2023-10-badger/blob/f2f2e2cf9965a1020661d179af46cb49e993cb7e/packages/contracts/contracts/BorrowerOperations.sol#L783
Vulnerability details
Impact
Not able to make position healthy when stETH collateral is paused
Proof of Concept
In BorrowOperation, the user and protocol relies on this function to move the collateral from the user to activePool
the user replies this funciton to add more collateral to make account healthy
however,
if we take a look at the stETH smart contract
https://etherscan.io/token/0xae7ab96520de3a18e5e111b5eaab095312d7fe84#readProxyContract
the implementation contract is https://etherscan.io/address/0x17144556fd3424edc8fc8a4c940b2d04936d17eb#code
when the admin of stETH paused the token, no transfer can be allowed and no flashloan can be borrowed
https://etherscan.io/address/0x17144556fd3424edc8fc8a4c940b2d04936d17eb#code#F27#L445
the admin on stETh can pause the contract to block collateral transfer
in this case, the interest still accuring while the user cannot make account more healthy by adding more collateral
in case when the stETH price drops, the user has no option, their position is subject to liquidation
Tools Used
Manual Review
Recommended Mitigation Steps
make sure interest is not accuring when the collateral token transfer is paused, and detect when the stETH unpause, leave sufficient time for user to add more collateral
Assessed type
Timing