Manipulation of target utilization via flash loans

Summary

Lack of withdrawal penalty for early collateral removals poses a risk of manipulation through flashloans despite EMA usage.

Vulnerability Detail

The Master Spec document describes how the manipulation of interest rates is meant to be deterred. For quote token deposits, a withdrawal penalty is applied for removals within 24h of deposits:

// apply early withdrawal penalty if quote token is removed from above the PTP
if (depositTime != 0 && block.timestamp - depositTime < 1 days) {
    if (removeParams.price > _ptp(poolState_.debt, poolState_.collateral)) {
        removedAmount_ = Maths.wmul(removedAmount_, Maths.WAD - _feeRate(poolState_.rate));
    }
}

For collateral deposits there is no such penalty, instead the EMA of TU prevents large manipulative collateral deposits (according to the Master Spec document). The idea behind this is that a malicious actor would be required to risk having his collateral in the pool for a prolonged time to manipulate the EMA as well as the related target utilization.

However, due to the fact that the EMA is only recorded every 12 hours, a malcious actor could perform a large collateral deposit using a flash loan (and instantly withdrawing) whenever the update is enabled. This way the EMA for target utilization can be manipulated risk free (except for flash loan fees).

Impact

Manipulation of target utilization to affect interest rates.

Code Snippet

https://github.com/sherlock-audit/2023-01-ajna/blob/main/contracts/src/libraries/external/LenderActions.sol#L379-L414

Tool used

Manual Review

Recommendation

Apply a withdrawal fee for early collateral withdrawals as well.

Duplicate of #101

sherlock-audit / 2023-01-ajna-judging

minhtrng - Manipulation of target utilization via flash loans #181