Submitted by gesha17, also found by grearlake, samuraii77, mt030d, KupiaSec, and VAD37
The protocol does not remove borrowed token liquidity from the aave pool once a loan is initiated. It only checks if there is enough available liquidity via the validateVariablePoolHasEnoughLiquidity() function. A user is expected to withdraw their funds after the loan is created. This means that a malicious user can sandwich loans that exceed the available liquidity in aave by depositing liquidity in a frontrun transaction and removing it in a backrun transaction. This way a user that takes out a loan will not be able to remove their funds until there is enough available liquidity in the pool.
Also note that liquidity may become unavailable via other factors, like external users removing liquidity from aave.
The sellCreditMarket() function does not remove liquidity from aave, but only checks if there is enough liquidity available via a call to validateVariablePoolHasEnoughLiquidity().
https://github.com/code-423n4/2024-06-size/blob/main/src/Size.sol#L194
Also, the executeSellCreditMarket() function transfers the size protocol accounting borrowAToken to the borrower, instead of the underlying token itself, leaving the user to withdraw their borrowed funds in a separate transaction.
https://github.com/code-423n4/2024-06-size/blob/main/src/libraries/actions/SellCreditMarket.sol#L202
The validateVariablePoolHasEnoughLiquidity() function only checks the balance of the variable pool, and does not remove liquidity:
https://github.com/code-423n4/2024-06-size/blob/main/src/libraries/CapsLibrary.sol#L67
Remove the liquidity from the pool when the loan is created and still let the user pull their funds in a separate transaction to remain compliant with pull over push pattern.
aviggiano (Size) acknowledged and commented:
hansfriese (judge) commented:
