Submitted by 0xbepresent, also found by Spearmint and Evo
https://github.com/code-423n4/2024-07-loopfi/blob/57871f64bdea450c1f04c9a53dc1a78223719164/src/CDPVault.sol#L509
https://github.com/code-423n4/2024-07-loopfi/blob/57871f64bdea450c1f04c9a53dc1a78223719164/src/CDPVault.sol#L713
In the CDPVault::liquidatePosition function, a liquidator can repay the total debt of a position to liquidate it, this can be achieved by calling the CDPVault::virtualDebt function to obtain the total debt and then call CDPVault::liquidatePosition. However, a malicious borrower can front-run this liquidation transaction by repaying a small amount (e.g., 1 wei) of the debt. This action causes the debt to be slightly less than the amount the liquidator intends to repay. Consequently, the subtraction operation in CDPVault#L713 will underflow, leading to a revert in the transaction. This will allow borrowers to evade total debt liquidation.
Consider the next scenario:
The next test demonstrates how the malicious borrower can evade full liquidation by repaying small amounts of the debt.
Implement a validation to prevent repayment if the position remains liquidable after increasing the repayment amount.
Under/Overflow
0xtj24 (LoopFi) acknowledged and commented:
Koolex (judge) commented:
