Submitted by kfx, also found by kinda_very_good, zxriptor, CaeraDenoir, grearlake (1, 2), falconhoof, 0x175, JohnSmith, Giorgio, JecikPo, jnforja, SpicyMeatball, shaka, givn, Aymen0909, AMOW, atoko, Norah, alexander_orjustalex, JCN (1, 2), web3Tycoon, erosjohn, lanrebayode77, nmirchev8, 0xjuan, and 0xAlix2
https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L696-L698
https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L973-L975
At the moment, both repay and liquidate calls will fail if the amount of shares that the transaction attempts to repay exceeds the outstanding debt shares of the position, with RepayExceedsDebt and DebtChanged errors respectively.
This enables an attacker to keep repaying very small amounts, such as 1 share, of the debt, causing user/liquidator transactions to fail.
The attack exposes risks for users who are close to the liquidation theshold from increasing their positions health, and also from self-liquidating their positions once theyre already below the threshold.
Allow to attempt to repay an unlimited amount of shares. Send back to the user tokens that were not required for the full repayment.
DoS
kalinbas (Revert) confirmed
ronnyx2017 (judge) commented:
Revert mitigated:
Status: Mitigation Confirmed. Full details in reports from b0g0, thank_you and ktg.
