Open c4-bot-4 opened 8 months ago
hansfriese marked the issue as primary issue
fez-init (sponsor) disputed
Frontrunning while repaying looks like an intended behavior although it might be unfair to borrowers after the unpausing
event.
Want to hear the sponsor's thoughts if any. @fez-init
hansfriese marked the issue as unsatisfactory: Invalid
Actually, this is a valid issue, but should be categorized as low/QA. The suggested mitigation also poses another attack vector that the position may not be liquidatable even if it's very risky already.
fez-init (sponsor) acknowledged
fez-init marked the issue as disagree with severity
hansfriese marked the issue as satisfactory
hansfriese changed the severity to QA (Quality Assurance)
hansfriese marked the issue as grade-a
Lines of code
https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/core/InitCore.sol#L535
Vulnerability details
Config
allows guardians to effectively 'pause' repayments and liquidation on specified pools and modes by changing thecanRepay
config variable:This could lead to a situation when during the 'unpausing' event liquidators would front-run users who want to repay their unhealthy positions.
Impact
Users that wish to repay their positions could be front-runned by liquidators in case protocol 'pausing' events would take place.
Proof of Concept
Consider the next scenario:
Recommended Mitigation Steps
Consider adding a grace period that would allow users to repay their positions after the 'canRepay' variable is returned to the 'true' value.
Assessed type
Other