Submitted by oakcobalt
Current pausing features allow a pool to be globally paused (all assets borrow, repay, liquidation pausing) and asset pausing (specific asset borrow, repay, liquidation pausing). See validatePoolBasic() and validateAssetBasic() which are checked in borrow, repay, and will revert if the pool or the asset is paused.
The problem is the borrow interest compounding implementation (InterestLogic::_updateBorrowIndex) will not factor in the duration of pausing when a user cannot repay a loan.
https://github.com/code-423n4/2024-07-benddao/blob/117ef61967d4b318fc65170061c9577e674fffa1/src/libraries/logic/InterestLogic.sol#L281
Interests continuously compound with no repayment allowed. When unpaused, many accounts are vulnerable to immediate liquidation out of users control.
Consider storing pause/unpause timestamp to allow skipping borrow interests compounding for the duration of the pause.
thorseldon (BendDAO) acknowledged and commented:
0xTheC0der (judge) commented:
