Tapioca DAO - ck's results

Lines of code

https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/2286f80f928f41c8bc189d0657d74ba83286c668/contracts/markets/bigBang/BigBang.sol#L263-L268

Vulnerability details

Impact

When BigBang::repay is paused, users will be unfairly liquidated. In periods of pausing users should be allowed to repay their loans to prevent going below the liquidation threshold.

Proof of Concept

The function BigBang::repay is implemented with pausing functionality as follows:

    function repay(
        address from,
        address to,
        bool,
        uint256 part
    ) public notPaused allowedBorrow(from, part) returns (uint256 amount) {

The issue is that during a period where the protocol is paused, the collateral value of a user can substantially decrease.

When the protocol is unpaused, the user would find themselves in a situation where they can be liquidated.

Opportunistic liquidators would wait for the unpause to happen and immediately liquidate the users before the get a chance to repay.

The protocol should therefore allow users to repay their loans even when the protocol is paused to prevent this.

Tools Used

Manual Review.

Recommended Mitigation Steps

Remove pause functionality from BigBang::repay.

Assessed type

Other