Submitted by Giorgio, also found by thank_you
https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L1078-L1080
When performing liquidation the liquidator will fill the LiquidateParams containing the liquidation details. The issue here is that instead of sending the liquidation rewards to the LiquidateParams.recipient, the rewards will be sent to msg.sender.
The liquidation rewards will be sent to msg.sender instead of the recipient, any external logic that relies on the fact that the liquidation rewards will be sent to recipient wont hold; this will influence the protocols composability.
In order to keep the system safe the liquidator can and is incentivised to liquidate unhealthy positions. To do so the liquidate() function will be fired with the appropriate parameters.
One of those parameters is the address recipient;; the name is quite intuitive for this one, this is where the liquidation rewards are expected to sent.
But if we follow the liquidation() function logic, the rewards will not be sent to recipient address. This piece of code handles the reward distribution.
We can see that msg.sender is being used instead of params.recipient.
The mitigation is straight forward. Use params.recipient instead of msg.sender for that specific call.
Context
kalinbas (Revert) confirmed
Revert mitigated:
Status: Mitigation confirmed. Full details in reports from b0g0, thank_you and ktg.
