A user can borrow liquidity, even though getPrincipalAmountAvailableToBorrow() < 0.
Summary
Borrowing is prevented when the percentage of lent amount relative to the poolTotalEstimatedValue is greater than the liquidityThresholdPercent. However, this restriction can be circumvented, as users are still able to borrow liquidity even in this case.
Vulnerability Detail
The getPrincipalAmountAvailableToBorrow() function prevents borrowing when the percentage of lent amount relative to the poolTotalEstimatedValue is greater than the liquidityThresholdPercent.
KupiaSec
medium
A user can borrow liquidity, even though
getPrincipalAmountAvailableToBorrow() < 0
.Summary
Borrowing is prevented when the percentage of lent amount relative to the
poolTotalEstimatedValue
is greater than theliquidityThresholdPercent
. However, this restriction can be circumvented, as users are still able to borrow liquidity even in this case.Vulnerability Detail
The
getPrincipalAmountAvailableToBorrow()
function prevents borrowing when the percentage of lent amount relative to thepoolTotalEstimatedValue
is greater than theliquidityThresholdPercent
.https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol##L779-L788
Consider the following scenario:
getPrincipalAmountAvailableToBorrow() == balanceOf(address(this))
.After the above scenario, all priciple tokens are lended, nothing left in the pool.
Impact
A user can borrow liquidity, even though
getPrincipalAmountAvailableToBorrow() < 0
. This may delay the withdraw time of liquidity providers.Code Snippet
https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol##L779-L788
Tool used
Manual Review
Recommendation
The interest rate mechanism should be improved. Additionally, there should be some time duration between deposit and withdrawal.
Duplicate of #68