Submitted by rbserver, also found by Picodes, Ch_301, Jeiwan, ElKu, 0xRobocop, MiloTruck, and sam_cunningham
When a user incurs a DBR deficit, a replenisher can call the forceReplenish function to force the user to replenish DBR. However, there is no guarantee that the forceReplenish function will always be called. When the forceReplenish function is not called, such as because that the replenisher does not notice the users DBR deficit promptly, the user can just call the repay function to repay the origianl debt and the withdraw function to receive all of the deposited collateral even when the user has a DBR deficit already. Yet, in the same situation, if the forceReplenish function has been called, more debt should be added for the user, and the user needs to repay more in order to get back all of the deposited collateral. Hence, when the forceReplenish function is not called while it could be called, the Market contract would receive less DOLA if the user decides to repay the debt and withdraw the collateral both in full.
https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L559-L572
https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L531-L539
https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L472-L474
https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L460-L466
Please add the following test in src\test\Market.t.sol. This test will pass to demonstrate the described scenario.
VSCode
When calling the repay function, the users DBR deficit can also be checked. If the user has a DBR deficit, an amount, which is similar to replenishmentCost that is calculated in the forceReplenish function, can be calculated; it can then be used to adjust the repay functions amount input for updating the states regarding the users and total debts in the relevant contracts.
08xmt (Inverse) disputed and commented:
