Inverse Finance contest - corerouter's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Market.sol#L607

Vulnerability details

Impact

In the current codes, liquidation fee will be paid only when there is enough fee in the escrow account. In reality, liquidation fee should be paid as much as possible, which means the existing balance in the escrow account should be paid when there is not enough fee in the escrow account.

Proof of Concept

https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Market.sol#L607

Tools Used

Recommended Mitigation Steps

The current logic shown as below:

if(escrow.balance() >= liquidationFee) { escrow.pay(gov, liquidationFee); }

Should be refactor to the codes shown as below:

if(escrow.balance() >= liquidationFee) { escrow.pay(gov, liquidationFee); } else { escrow.pay(gov, escrow.balance()); }