Skip to content
Request an audit

‹ All findings

Base calculation in Leverager::isLiquidateable() is incorrect as the max leverage may be smaller

Crit/HighYieldoor·Sherlock · CLMM · 24th February 2025CodebaseH-4

ReportSource

Summary

Base calculation in Leverager::isLiquidateable() is: uint256 base = owedAmount * 1e18 / (vp.maxTimesLeverage - 1e18);. However, the max leverage may not actually be vp.maxTimesLeverage, but be maxLevTimes from the lending pool. In this case, the base amount would be incorrectly underestimated, leading to users not being liquidated when they should for the protocol's loss (loss of profit and higher bad debt risk).

Root Cause

In Leverager:408, the max leverage from the lending pool is not taken into account.

Internal Pre-conditions

maxLevTimes from the lending pool < vp.maxTimesLeverage.

External Pre-conditions

None.

Attack Path

  1. User has a position that should be liquidated but isn't due to the rhs of the is liquidatable check.

Impact

Protocols takes losses and risks bad debt creation.

PoC

If maxLevTimes < vp.maxTimesLeverage, it means the base calculation would have in the divisor a bigger number than it should, so base will be smaller. As base is smaller, the collateral of the user can decrease more without the user being liquidated.

Mitigation

Compare the 2 max leverage values and use the smallest, which is the actual maximum leverage allowed in the Leverager.