rvierdiiev - In case if pool is paused, then borrower can't avoid liquidation

[sherlock-admin]

rvierdiiev

medium

In case if pool is paused, then borrower can't avoid liquidation

Summary

In case if pool is paused, then borrower can't avoid liquidation as his all actions are blocked

Vulnerability Detail

In case if prices from uniswap seems to be manipulated, then pool is paused for 30 minutes.

Once it's done, then borrower can't do anything using modify function. This check is skipped only if borrower has no liabilities. This means that all funds that are currently in the Borrower contract and in uniswap under Borrower positions are locked.

This becomes a problem for owner of Borrower, when he is warned and he now has 2 minutes to adjust his positions. Owner of Borrower can repay directly to the lender contract on behalf of Borrower, but it's possible that Borrower has another strategy to manage such cases and he needs access to his uniswap positions and Borrower's balance to do so.

Impact

Borrower can't use own funds to make situation better after he is warned and pool is paused.

Code Snippet

Provided above

Tool used

Manual Review

Recommendation

I don't know good solution here, as you trying to not allow them to get funds out of contract in case if prices are broken and you can't detect if borrower doesn't try to cheat. But still this can lead to loss for borrower in from of incentive for liquidator.

Duplicate of #72

[sherlock-admin2]

2 comment(s) were left on this issue during the judging contest.

panprog commented:

valid medium, dup of #15

MohammedRizwan commented:

seems intended design

[haydenshively]

Distinct from the {#15, #27, #72, #111} group, as those are saying that liquidations should be paused if !seemsLegit. This is saying that modify's behavior (which does get paused) is detrimental to borrowers.

This is low/informational because the Borrower's owner actually can call modify, so long as they repay all borrows by the end of it. For example, they could burn Uniswap liquidity, exercise trades to get appropriate amounts of each token, and finish by calling repay.