# Bad debt is never handled which places insolvency risks on BendDAO Crit/High · Code4rena · NFT lending · 19th June, 2024 Finding H-05 of the BendDAO security review. - Protocol: https://www.benddao.xyz/ - Report: /reports/benddao - Codebase: https://github.com/0xsimao/2024-07-benddao/tree/117ef61967d4b318fc65170061c9577e674fffa1 - Source: https://code4rena.com/reports/2024-07-benddao --- Bad debt is never handled, which may happen whenever the collateral asset price crashes or the debt value spikes. Whenever this happens `ERC20` positions will be partially liquidated and `ERC721` positions will not be profitable for liquidation, which means the debt will not be repaid. When this happens, the protocol will not have enough liquidity to fulfill withdrawals, DoSing them forever or until the price comes back up again. ### Proof of Concept `LiquidationLogic::executeCrossLiquidateERC20()` [allows](https://github.com/code-423n4/2024-07-benddao/blob/main/src/libraries/logic/LiquidationLogic.sol#L99-L105) partial, liquidations, so the likely outcome here would be liquidation of the debt corresponding to the available collateral, but some debt could be outstanding. `ERC721` liquidations don't allow partial liquidations in the same way, as the price of each collateral asset is based on the debt value only, so it could happen that these debt assets are not liquidated at all. As withdrawing deposits depends on the protocol having liquidity, if these assets are borrowed and there is no way to repay them, users will not be able to withdraw. ### Tools Used Vscode, Foundry ### Recommended Mitigation Steps On liquidation, place a mechanism to handle the creation of bad debt. This could be implemented as a reserve or by decreasing the supply index or similar, so the bad debt is redistributed by the suppliers. --- Related findings: - [Liquidations will leave dust when repaying expired maturities, making it impossible to clear bad debt putting the protocol at a risk of insolvency](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-liquidations-dust-debt-insolvency): Exactly Protocol Update - Staking Contract - [Most `ManagedLeveragedVault` functions are DoSed due to bad debt check](https://0xsimao.com/findings/beraborrow-i-managed-functions-bad-debt): Beraborrow Managed Dens - [Some bad debt will not be cleared when it should which will cause accrual of bad debt decreasing the protocol's solvency](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-debt-cleared-accrual-solvency): Exactly Protocol Update - Staking Contract - [Liquidator will leave a pool with unassigned earnings on `Market::clearBadDebt()` free to claim for anyone when the repaid maturity is not the last](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-liquidator-clear-debt-repaid): Exactly Protocol Update - Staking Contract