Submitted by 0xbepresent, also found by Arz, Audinarey (1, 2), c0pp3rscr3w3r, stackachu, memforvik, HALITUS, Infect3d, Udsen, Toshii, J4X, Aymen0909, Kalyan-Singh, 0xlemon, novodelta, mussucal, Draiakoo, 0xpiken, zhaojie, zhaojohnson, 00xSEV, juancito, CaeraDenoir, n0kto, DanielArmstrong, Auditwolf, Krace, israeladelaja, 0xAsen, pkqs90, PENGUN, 0xBinChook, lanrebayode77, twcctop, KingNFT, Jorgect, b0g0, 0xRobocop, 0xCiphky, djxploit, erosjohn, holydevoti0n, Banditx0x, iamandreiski, ayden, 0xanmol, klau5, solmaxis69, developerjordy, and 0xAlix2
https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/stable/CollateralAndLiquidity.sol#L140 
https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/stable/CollateralAndLiquidity.sol#L70
The CollateralAndLiquidity contract contains a critical vulnerability that allows a user undergoing liquidation to evade the process by manipulating the user.cooldownExpiration variable. This manipulation is achieved through the CollateralAndLiquidity::depositCollateralAndIncreaseShare function, specifically within the StakingRewards::_increaseUserShare function (code line #70):
Malicious user can perform front-running of the liquidation function by depositing small amounts of tokens to his position, incrementing the user.cooldownExpiration variable. Consequently, the execution of the liquidation function will be reverted with the error message Must wait for the cooldown to expire. This vulnerability could lead to attackers evading liquidation, potentially causing the system to enter into debt as liquidations are avoided.
A test case, named testUserLiquidationMayBeAvoided, has been created to demonstrate the potential misuse of the system. The test involves the following steps:
Consider modifying the liquidation function as follows:
This modification ensures that the user.cooldownExpiration expiration check does not interfere with the liquidation process, mitigating the identified security risk.
othernet-global (Salty.IO) confirmed and commented:
Status: Mitigation confirmed. Full details in reports from zzebra83, 0xpiken, and t0x1c.
