Closed sherlock-admin2 closed 6 months ago
1 comment(s) were left on this issue during the judging contest.
takarez commented:
invalid: the liquidation will also be paused in that case; so invalid
Invalid based on sherlock rules
- An admin action can break certain assumptions about the functioning of the code. Example: Pausing a collateral causes some users to be unfairly liquidated or any other action causing loss of funds. This is not considered a valid issue.
Nihavent
medium
[M-1] Accounts can be liquidated when deposits are paused
[M-1] Accounts can be liquidated when deposits are paused, resulting in unwarrented liquidations.
Summary
The
RegistryGuardian
address has the ability to pause deposits and withdrawals. Despite this role being a trusted position, when the protocol is paused users (accounts) are unable to manage their positions by depositing and withdrawing collateral. In the event that deposits are paused, and an accounts' asset valuation decreases belowopenDebt + minimumMargin
, this user becomes liquidatable. Under normal circumstances, some of these users may have deposited more collateral, or closed their open positions before they were liquidatable, which means some of these liquidations are unwarrented.Vulnerability Detail
When the
RegistryGuardian::pause()
function is paused, both deposits and withdrawals are paused until the protocol is either unpaused by the guardian or 30 days has elapsed:https://github.com/sherlock-audit/2023-12-arcadia/blob/main/accounts-v2/src/guardians/RegistryGuardian.sol#L63-L66
When deposits and withdrawals are paused users cannot manage their open positions. These users may be subject to liquidation, even if they intend to deposit funds to protect against liquidation.
Impact
Users may be subject to liquidation if the protocol is paused in unfavourable market conditions. These liquidations may be unwarrented and place user funds at risk.
Code Snippet
Copy the following into a new file in Accounts-V2/test/accounts/AccountV1/
Then run
forge test --mt test_startLiquidationWhenDepositsPaused
Tool used
Manual Review
Recommendation
Allow users to manage positions when protocol is paused. One way to achieve this is by increasing the flexibility of the
RegistryGuardian::pause()
to pause withdrawals but not pause deposits. This would allow users to ensure they avoid unwanted liquidations in a market downturn.