clems4ever - priceLiquidity may revert in directional market conditions preventing legitimate liquidations

[github-actions]

clems4ever

medium

priceLiquidity may revert in directional market conditions preventing legitimate liquidations

Summary

In the case a token collapses in value against USDC, there are strong chances that the pool will not be aligned with the oracle value. In that case, liquidators would not be able to call callLiquidation because of the boundary check in priceLiquidity.

https://github.com/sherlock-audit/2022-11-isomorph/blob/main/contracts/Velo-Deposit-Tokens/contracts/DepositReceipt_ETH.sol#L142

Vulnerability Detail

Impact

This is a legitimate case where the user which has deposited LP tokens should get liquidated, but liquidators are unable to do so. This leads to bad debt for the protocol.

Code Snippet

Tool used

Manual Review

Recommendation

Instead of implementing a custom flash loan protection, it would be safer to use fair LP token pricing described here:
https://blog.alphaventuredao.io/fair-lp-token-pricing/
It is not manipulatable by using a flash loan because imbalancing the pool does not increase the value of LP tokens.

Duplicate of #70

[kree-dotcom]

Interesting article linked on this however with how wide the minPrice and maxPrice of Chainlink feeds are ($10, $1,000,000 for ETH for example) any legitimate use is likely to have incurred Bad debt anyway. If ETH flash crashes to $10 it is likely no liquidators will want to act anyway. We will have to read on the issue further and consider if this is worth fixing.

[IAm0x52]

Duplicate of #70