Submitted by Arabadzhiev, also found by Koolex
Users can bypass the repayment of their loans when claiming their collateral, which can be abused in order to drain any trading pool.
The borrow_collateral function located inside the swapback.rs file lacks a crucial instruction validation check - a check for verifying that the random_account_as_id value passed into the repay_sol instruction context is not the same as that passed into the borrow_collateral instruction context. What this effectively means is that users can pass in an instruction that calls repay_sol with a position_account value that is different than the one passed into borrow_collateral. This can be abused in order to claim the collateral for one position, while repaying the borrowed SOL for another (even if that one was already repaid), making it possible to claim back collateral while repaying practically nothing, if the repayed position is one with a dust amount borrowed.
The following coded PoC demonstrates the issue at question. To run it, paste it at the bottom of the lavarage describe block in the lavarage.spec.ts test file and then run anchor test in libs/smart-contracts. The tests inside lavarage.spec.ts are stateful, so the order in which they are executed does matter.
Replace the current verification checks with a single one for the position_account value:
Invalid Validation
piske-alex (Lavarage) confirmed
