Skip to content
Request an audit

‹ All findings

Bad debt is never handled which places insolvency risks on BendDAO

Crit/HighBendDAO·Code4rena · NFT lending · 19th June, 2024CodebaseH-05

Bad debt is never handled, which may happen whenever the collateral asset price crashes or the debt value spikes. Whenever this happens ERC20 positions will be partially liquidated and ERC721 positions will not be profitable for liquidation, which means the debt will not be repaid. When this happens, the protocol will not have enough liquidity to fulfill withdrawals, DoSing them forever or until the price comes back up again.

Proof of Concept

LiquidationLogic::executeCrossLiquidateERC20() allows partial, liquidations, so the likely outcome here would be liquidation of the debt corresponding to the available collateral, but some debt could be outstanding. ERC721 liquidations don't allow partial liquidations in the same way, as the price of each collateral asset is based on the debt value only, so it could happen that these debt assets are not liquidated at all.

As withdrawing deposits depends on the protocol having liquidity, if these assets are borrowed and there is no way to repay them, users will not be able to withdraw.

Tools Used

Vscode, Foundry

Recommended Mitigation Steps

On liquidation, place a mechanism to handle the creation of bad debt. This could be implemented as a reserve or by decreasing the supply index or similar, so the bad debt is redistributed by the suppliers.