Skip to content

Latest commit

 

History

History
43 lines (28 loc) · 2.58 KB

019.md

File metadata and controls

43 lines (28 loc) · 2.58 KB

Obedient Lava Monkey

Medium

Improper Validation of isolationModeTotalDebt Update in executeBorrow Allows Exceeding isolationModeDebtCeiling

Summary

In BorrowLogic.sol, improper updating of the isolation mode debt ceiling will cause overexposure for the protocol as the contract will allow borrowing that exceeds the configured debt ceiling.

Root Cause

In BorrowLogic.sol, the isolation mode debt is updated without a check to ensure that the new total debt remains within the isolation mode debt ceiling. The root cause of the issue is that in the executeBorrow function, the isolationModeTotalDebt is incremented with the borrowed amount without checking if this new total exceeds the isolationModeDebtCeiling. This lack of validation allows the total debt in isolation mode to surpass the maximum limit set by the protocol, which should prevent over-borrowing against isolated assets.

Internal Pre-conditions

  1. The reserve needs to be in isolation mode.
  2. The user needs to borrow an amount that, when added to the current isolationModeTotalDebt, exceeds the isolationModeDebtCeiling.

External Pre-conditions

  1. The external oracle price for the collateral asset remains constant or increases.
  2. There are no protocol-level safeguards or constraints set on the total debt in isolation mode by other contracts or administrative actions.

Attack Path

  1. A user calls the executeBorrow function with a borrow amount that, when added to the current isolation mode debt, exceeds the configured ceiling.
  2. The isolationModeTotalDebt is updated without validation, bypassing the debt ceiling limit.
  3. The borrow is processed successfully, even though it violates the protocol's debt ceiling constraint.

Impact

The protocol suffers an increased risk of insolvency due to overexposure to the isolated asset. This can lead to financial loss if the asset value drops, and the debt surpasses the collateral's value, potentially resulting in under-collateralized loans.

Mitigation

Add a validation check to ensure that the updated total debt does not exceed the isolation mode debt ceiling before updating the isolationModeTotalDebt.