sherlock-audit / 2023-10-real-wagmi-judging

16 stars 14 forks source link

jah - the function takeoverDebt doesn't properly update the liquidator balance #187

Closed sherlock-admin closed 11 months ago

sherlock-admin commented 11 months ago

jah

high

the function takeoverDebt doesn't properly update the liquidator balance

Summary

the function takeoverdebt doesn't not properly update the liquidator balance

Vulnerability Detail

the function takeoverdebt is used to liquidate another borrower and transfer the position into the liquidator and when transferring the loan[] using _addKeysAndLoansInfo(newBorrowing.borrowedAmount > 0, borrowingKey, oldLoans); it is using the liquidated borrowingkey instead of the new one so the loan will will be updated into the previous one so when repaying using the repay function it might not use all the position

Impact

loss of fund

Code Snippet

https://github.com/sherlock-audit/2023-10-real-wagmi/blob/main/wagmi-leverage/contracts/LiquidityBorrowingManager.sol#L441

Tool used

Manual Review

Recommendation

use newBorrowingKey instead of borrowingKey

Duplicate of #53