sherlock-audit / 2023-01-ajna-judging

1 stars 0 forks source link

Jeiwan - The kick penalty affects taking, increasing BPF and quote/collateral tokens require for a take #152

Closed github-actions[bot] closed 1 year ago

github-actions[bot] commented 1 year ago

Jeiwan

medium

The kick penalty affects taking, increasing BPF and quote/collateral tokens require for a take

Summary

The kick penalty, besides penalizing borrowers, also affects taking: BPF may be increased; the amount of quote/collateral tokens required to repay the debt may be increased.

Vulnerability Detail

As per the whitepaper:

The moment that a loan goes into liquidation its debt is increased by 90 days of interest, based on the current interest rate. This is done to disincentivize borrowers from repaying their loans only after it has been liquidated.

However, the penalty also increases the total borrower's debt to be repaid, which affects taking in multiple way:

  1. When TP < NP, the BPF may be higher than expected because the kick penalty increases TP: the higher the debt, the higher the TP. A higher BPF increases the bond reward and may turn it from a negative one to a positive one.
  2. A higher debt will require more quote/collateral tokens to repay the debt (Auctions.sol#L1143-L1155).

    Impact

    Taking is affected in the following ways:

  3. BPF increases, which increases the bond reward for kickers.
  4. More funds is required to repay the debt.

    Code Snippet

    Auctions.sol#L810-L811 Auctions.sol#L832 Auctions.sol#L1487 Auctions.sol#L1429 Auctions.sol#L1143-L1155

    Tool used

    Manual Review

    Recommendation

    Consider storing the kick penalty in the IPoolState.Borrower structure as a separate value and add it to borrower's debt only when borrower repays a debt after a liquidation has started.

grandizzy commented 1 year ago

the code and the whitepaper are aligned and it is true that the increasing debt affects the BPF, this is per design