Ethereum Credit Guild - glorySec's results

Lines of code

https://github.com/volt-protocol/ethereum-credit-guild/blob/main/src/loan/LendingTerm.sol#L634-L675

Vulnerability details

Impact

There is no way to liquidate the loan for terms with no partial repayment (maxDelayBetweenPartialRepay = 0).

Hence, it results in either of two things:

1. Bad debt is collected
2. The term is offboarded resulting in healthy loans to get liquidated.

Proof of Concept

https://github.com/volt-protocol/ethereum-credit-guild/blob/main/src/loan/LendingTerm.sol#L634-L675

require(
            GuildToken(refs.guildToken).isDeprecatedGauge(address(this)) ||
                partialRepayDelayPassed(loanId),
            "LendingTerm: cannot call"
);

The call function only allows calling loans based on two conditions:

1. The gauge has been deprecated (generally the case with off-boarding term)
2. The delay after the last re-payment has passed maxDelayBetweenPartialRepay

But if the maxDelayBetweenPartialRepay is set to 0, the partialRepayDelayPassed function always returns false, which results in the call function getting reverted as well. https://github.com/volt-protocol/ethereum-credit-guild/blob/main/src/loan/LendingTerm.sol#L240-L241

function partialRepayDelayPassed(
        bytes32 loanId
    ) public view returns (bool) {
        // if no periodic partial repays are expected, always return false
        if (params.maxDelayBetweenPartialRepay == 0) return false;

        // if loan doesn't exist, return false
        if (loans[loanId].borrowTime == 0) return false;

        // if loan is closed, return false
        if (loans[loanId].closeTime != 0) return false;

        // return true if delay is passed
        return
            lastPartialRepay[loanId] <
            block.timestamp - params.maxDelayBetweenPartialRepay;
    }

Hence liquidation never happens for the loans in terms with maxDelayBetweenPartialRepay set to 0.

Tools Used

Manual

Recommended Mitigation Steps

There should be a way to liquidate specific loans in terms where maxDelayBetweenPartialRepay is set to 0.

Assessed type

Other