The partialRepay() function may not be usable in some cases

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/LendingTerm.sol#L523-L531

Vulnerability details

Impact

When partially paying the debt, the repayment percent amount needs to be greater than minPartialRepayPercent and the remaining debt needs to be greater than the minBorrow amount.

require(
            debtToRepay >= (loanDebt * params.minPartialRepayPercent) / 1e18,
            "LendingTerm: repay below min"
        ); 
        require(
            borrowAmount - issuanceDecrease >
                ProfitManager(refs.profitManager).minBorrow(),
            "LendingTerm: below min borrow"
        );

The minimum repayment percentage may result in a remaining debt lower than the minimum borrowing amount, leading to a revert. The partialRepay() function may not always be available, preventing users from repaying their debts in dire situations which can result in liquidation.

Proof of Concept

POC:
LendingTerm.t.sol

function testMinPartialRepayPercent() public {
        // create a similar term but with 5% opening fee
        LendingTerm term2 = LendingTerm(
            Clones.clone(address(new LendingTerm()))
        );
        term2.initialize(
            address(core),
            term.getReferences(),
            LendingTerm.LendingTermParams({
                collateralToken: address(collateral),
                maxDebtPerCollateralToken: _CREDIT_PER_COLLATERAL_TOKEN,
                interestRate: _INTEREST_RATE,
                maxDelayBetweenPartialRepay: _MAX_DELAY_BETWEEN_PARTIAL_REPAY,
                minPartialRepayPercent: _MIN_PARTIAL_REPAY_PERCENT,
                openingFee: 0.1e18,
                hardCap: _HARDCAP
            })
        );
        vm.label(address(term2), "term2");
        guild.addGauge(1, address(term2));
        guild.decrementGauge(address(term), _HARDCAP);
        guild.incrementGauge(address(term2), _HARDCAP);
        vm.startPrank(governor);
        core.grantRole(CoreRoles.RATE_LIMITED_CREDIT_MINTER, address(term2));
        core.grantRole(CoreRoles.GAUGE_PNL_NOTIFIER, address(term2));
        vm.stopPrank();

        // prepare
        uint256 borrowAmount = 200e18;
        uint256 collateralAmount = 12e18;
        collateral.mint(address(this), collateralAmount);
        collateral.approve(address(term2), collateralAmount);

        // borrow
        bytes32 loanId = term2.borrow(borrowAmount, collateralAmount);
        vm.warp(block.timestamp + term2.YEAR());
        vm.roll(block.number + 1);
        term2.getLoanDebt(loanId); // 240e18
        credit.approve(address(term2), 1000e18);
        term2.partialRepay(loanId, 110e18);

        //@audit
        term2.getLoanDebt(loanId); // 130e18 debt
        vm.expectRevert("LendingTerm: below min borrow");
        term2.partialRepay(loanId, 26.1e18); // minPartialRepayPercent is 20%
    }

Tools Used

Manual Review

Recommended Mitigation Steps

Delete the minPartialRepayPercent check inside the _partialRepay() function.

Assessed type

Other

[c4-pre-sort]

0xSorryNotSorry marked the issue as sufficient quality report

[c4-pre-sort]

0xSorryNotSorry marked the issue as duplicate of #1182

[c4-judge]

Trumpero changed the severity to QA (Quality Assurance)

[c4-judge]

Trumpero marked the issue as grade-b

[c4-judge]

Trumpero marked the issue as grade-c