If some tranche (`trancheId`) would be paused, the borrowers who borrowed from the tranche can not repay their debt and there their collaterals will eventually be liquidated

[hats-bug-reporter[bot]]

Github username: @0xmuxyz Submission hash (on-chain): 0xb489f535f6724a18adc4ebe918ce1ef0823e704af9ea37d624924d56555f0a0d Severity: medium severity

Description:

Description

Within the LendingPool, the whenTrancheNotPausedAndExists() modifier would be defined in order to check whether or not a given Tranche (trancheId) would not be paused and exists like this:

    modifier whenTrancheNotPausedAndExists(uint64 trancheId) {
        _whenTrancheNotPausedAndExists(trancheId);
        _;
    }

    function _whenTrancheNotPausedAndExists(uint64 trancheId) internal view {
        require(!trancheParams[trancheId].paused && !_everythingPaused, Errors.LP_IS_PAUSED);
        uint64 totalTranches = ILendingPoolConfigurator(_addressesProvider.getLendingPoolConfigurator()).totalTranches();
        require(trancheId<totalTranches, Errors.INVALID_TRANCHE);
    }

The whenTrancheNotPausedAndExists() modifier would be used on the LendingPool#borrow() like this:

    function borrow(
        address asset,
        uint64 trancheId,
        uint256 amount,
        uint16 referralCode,
        address onBehalfOf
    )
        external
        override
        whenTrancheNotPausedAndExists(trancheId) /// @audit
    {
        ...

However, the whenTrancheNotPausedAndExists() modifier would also be used on the LendingPool#repay() like this:

    function repay(
        address asset,
        uint64 trancheId,
        uint256 amount,
        address onBehalfOf
    ) external override whenTrancheNotPausedAndExists(trancheId) returns (uint256) {  /// @audit
        ...

This is problematic. Because if a given Tranche (trancheId) would be paused, the borrowers who borrowed the debt from the given Tranche (trancheId) before the tranche was paused can not repay their debt. As a result, their debt will eventually be liquidated, which means that the borrowers lose their collaterals.

Attack scenario

1: A borrower borrow the amount of debt from a tranche (Let's say trancheId = 1). 2: After that, the tranche admin of the tranche (trancheId = 1) decide to pause their tranche and execute it. 3: The borrower, who borrowed from the tranche (trancheId = 1) at the step1 above, can not repay their debt. Because when the borrower call the LendingPool#repay(), it will be reverted by the whenTrancheNotPausedAndExists() modifier on the the LendingPool#repay(). 4: The debt of the borrower will eventually liquidated and therefore the borrower lose their collateral.

Recommendations

Consider removing the whenTrancheNotPausedAndExists() modifier from the LendingPool#repay() so that the borrowers, who borrowed the debt from the given tranche (trancheId) before the tranche was paused, can repay their debt even if that Tranche (trancheId) would be paused.

[ksyao2002]

Duplicated: https://github.com/hats-finance/VMEX-0x050183b53cf62bcd6c2a932632f8156953fd146f/issues/46