Submitted by Banditx0x, also found by Audinarey, Giorgio, and t0x1c
The minimum collateral is enforced to prevent a well known vulnerability - there is no incentive to liquidate small loans. Therefore the impact of this check being bypassed is the same - small loans will not be liquidated which can lead to bad debt in the protocol.
The minimum collateral is enforced in the when borrowing USDS, during the call to the maxBorrowableUSDS function. However this check is not applied when the user withdraws collateral. Therefore, a loan with small collateral can be created by:
Why small loans are an issue:
The liquidation reward is based off a flat 5% of the collateral being liquidated. There is no minimum cap to the liquidation fee.
Lets have an example where gas costs are $5. The collateral being liquidated needs to be $100 USDS or more for the liquidation costs to be worth the reward.
However, a loan that is worth $100 at liquidation is actually worth far more than that upon time of opening. For example, opened at the minimum collateral factor of 200%, the loan is actually worth slightly less than $200 when it was opened, and then decreased to $100. With even lower-leverage positions with 400% CF, it is reasonable that position sizes are $400 or more upon time of opening.
The minimum collateral should be enforced on withdrawals whenever a user has an active USDS loan.
Picodes (Judge) decreased severity to Medium and commented:
othernet-global (Salty.IO) acknowledged and commented:
Status: Mitigation confirmed. Full details in reports from t0x1c, zzebra83, and 0xpiken.
