USDS borrowers can prevent liquidation by periodically touching their liquidities

[c4-bot-1]

Lines of code

https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/stable/CollateralAndLiquidity.sol#L154

Vulnerability details

Impact

In current implementation, liquidation would fail while borrowers are in operation cool down. Users could periodically add negligible liquidity to keep in cool down and prevent liquidation in realistic time range such as some days.

Proof of Concept

The issue arises on L154 of liquidateUser() function, the last parameter useCooldown is set to true, this would trigger revert on L107 if the user being liquidated is under cooldown.

File: src\stable\CollateralAndLiquidity.sol
140: 	function liquidateUser( address wallet ) external nonReentrant
141: 		{
...
154: 		_decreaseUserShare( wallet, collateralPoolID, userCollateralAmount, true ); // @audit true => false
...
188: 		}

File: src\staking\StakingRewards.sol
097: 	function _decreaseUserShare( address wallet, bytes32 poolID, uint256 decreaseShareAmount, bool useCooldown ) internal
098: 		{
...
104: 		if ( useCooldown )
105: 		if ( msg.sender != address(exchangeConfig.dao()) ) // DAO doesn't use the cooldown
106: 			{
107: 			require( block.timestamp >= user.cooldownExpiration, "Must wait for the cooldown to expire" );
108: 
109: 			// Update the cooldown expiration for future transactions
110: 			user.cooldownExpiration = block.timestamp + stakingConfig.modificationCooldown();
111: 			}
...
140: 		}

Now, let's say the WBTC or WETH price quickly fall and make some users' collateral value decreasing to near liquidation threshold. Users could add negligible liquidity to refresh coolDown time rather than increasing liquidity or repaying USDS to prevent liquidation. To be even worse, users could try to refresh coolDown repeatedly. This would significantly increase depeg risk of USDS in such market situation.

Tools Used

Manually review

Recommended Mitigation Steps

See PoC

Assessed type

Error

[c4-judge]

Picodes marked the issue as duplicate of #891

[c4-judge]

Picodes marked the issue as satisfactory

[c4-judge]

Picodes changed the severity to 3 (High Risk)