rvierdiiev - Cooler.repay doesn't repay correctly in some cases

[github-actions]

rvierdiiev

medium

Cooler.repay doesn't repay correctly in some cases

Summary

Cooler.repay doesn't repay correctly in some cases.

Vulnerability Detail

Cooler.repay function allows borrower to repay part or all his debt.

https://github.com/sherlock-audit/2023-01-cooler/blob/main/src/Cooler.sol#L108-L124

    function repay (uint256 loanID, uint256 repaid) external {
        Loan storage loan = loans[loanID];


        if (block.timestamp > loan.expiry) 
            revert Default();
        
        uint256 decollateralized = loan.collateral * repaid / loan.amount;


        if (repaid == loan.amount) delete loans[loanID];
        else {
            loan.amount -= repaid;
            loan.collateral -= decollateralized;
        }


        debt.transferFrom(msg.sender, loan.lender, repaid);
        collateral.transfer(owner, decollateralized);
    }

When user repays repaid amount of debt token, then decollateralized amount of collatrela token is calculated for him and sent back.

Suppose that user took 1_000_000 token's loan and collateralized it with 1000 tokens of collateral.
That means that when user repays 1000 loan's tokens he receive back 1 collateral token a ratio is 1:1000.
Then he calls repay with repaid = 999.
As result decollateralized will be calculated as 0 and it's correct. loan.amount becomes 999_001.
Then he calls repay with same param 999, and again he receives 0 collateral tokens back.
But in this case it's incorrect as he already repaid more than 1998 loan's token and regarding to ratio should receive 1 collateral token back.

As result if user repays with small amount in this case, then collateral that is unblocked calculated incorrectly.
In case if borrower will continue payments and repay his loan, then in the end he will receive correct amount of collateral back, but if for example user will not pay his loan(after 2 payments that i have described), then when lender will default loan, lender will receive all collateral and as result borrower loses his 1 token of collateral that he repaid.

Impact

Loss of funds for borrower.

Code Snippet

Tool used

Manual Review

Recommendation

You need to repay all amount of collateral to borrower that he repaid already.

Duplicate of #263