Submitted by said
In the scenario where the modes canRepay status is set to false, positions using that mode cannot be repaid and liquidated. However, users are allowed to change their positions mode to one where the canRepay status is currently set to false. This could be exploited when a position owner observes that their positions health is approaching the liquidation threshold, allowing them to prevent liquidation.
It can be observed that when setPosMode is called, it checks that newModeStatus.canBorrow and currentModeStatus.canRepay is set to true. However, it doesnt check the status of newModeStatus.canRepay flag.
https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/core/InitCore.sol#L203-L204
As mentioned before, if users see his positions health status is about to reach liquidation threshold and change the mode, this will allow users to prevent their positions from getting liquidated, as both liquidate and liquidateWLp will check the canRepay flag and revert if its not allowed.
https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/core/InitCore.sol#L282-L314
https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/core/InitCore.sol#L317-L353
https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/core/InitCore.sol#L587-L599
https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/core/InitCore.sol#L530-L551
Add a canRepay check status inside setPosMode; if it is paused, revert the change. Besides that, the canRepay and canBorrow checks dont need to be inside the pools check loop.
fez-init (INIT) confirmed
