joestakey - There is no liquidation incentive if `maxCollateralRatioMantissa >= 1e18`

[github-actions[bot]]

joestakey

medium

There is no liquidation incentive if maxCollateralRatioMantissa >= 1e18

Summary

There is no incentive for liquidators if maxCollateralRatioMantissa >= 1e18

Vulnerability Detail

The collateral reward sent back to a liquidator is computed as follow:

File: src/Pool.sol
579:         uint collateralReward;
580:         if(_amount == type(uint).max || _amount == userDebt) {
581:             collateralReward = collateralBalance;
582:             _shares = debtSharesBalanceOf[_borrower];
583:             _amount = userDebt;
584:         } else {
585:             uint userInvertedCollateralRatioMantissa = collateralBalance * 1e18 / userDebt;
586:             collateralReward = _amount * userInvertedCollateralRatioMantissa / 1e18; // rounds down
587:             _shares = tokenToShares(_amount, _currentTotalDebt, _debtSharesSupply, false);
588:         }

In the case of a full liquidation, collateralReward == collateralBalance.

There is no additional incentive amount sent to the liquidator. This is a problem in cases when maxCollateralRatioMantissa >= 1e18: there is absolutely no incentive for users to call liquidate, as the collateral they would receive would be the same value as their repay amount.

Impact

It affects pool in the edge case where maxCollateralRatioMantissa == 1e18.

Looking at pool deployments, the only requirement on _maxCollateralRatioMantissa is the following:

63:         require(_maxCollateralRatioMantissa > 0, "Pool: _maxCollateralRatioMantissa too low");

Meaning this is a valid edge case to look at.

Code Snippet

https://github.com/sherlock-audit/2023-02-surge/blob/main/surge-protocol-v1/src/Pool.sol#L580-L588

Tool used

Manual Review

Recommendation

Consider creating a liquidation incentive system, where perhaps some of the balances of liquidity providers would be deducted to reward liquidators during liquidations.

[Evert0x]

Closing as informational