rvierdiiev - LiquidationRow.liquidateVaultsForToken will never work, so vault depositors will not receive any rewards

[sherlock-admin2]

rvierdiiev

high

LiquidationRow.liquidateVaultsForToken will never work, so vault depositors will not receive any rewards

Summary

LiquidationRow.liquidateVaultsForToken will never work, so vault depositors will not receive any rewards

Vulnerability Detail

LiquidationRow.liquidateVaultsForToken function should swap reward assets of the vault and then send them to the rewarder for distribution.
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/liquidation/LiquidationRow.sol#L167-L180

    function liquidateVaultsForToken(
        address fromToken,
        address asyncSwapper,
        IDestinationVault[] memory vaultsToLiquidate,
        SwapParams memory params
    ) external nonReentrant hasRole(Roles.LIQUIDATOR_ROLE) onlyWhitelistedSwapper(asyncSwapper) {
        uint256 gasBefore = gasleft();


        (uint256 totalBalanceToLiquidate, uint256[] memory vaultsBalances) =
            _prepareForLiquidation(fromToken, vaultsToLiquidate);
        _performLiquidation(
            gasBefore, fromToken, asyncSwapper, vaultsToLiquidate, params, totalBalanceToLiquidate, vaultsBalances
        );
    }

The problem is inside _performLiquidation function.
This function calls should swap tokens, but it never sends tokens to the swapper.
Because swapper also doesn't send nothing to the LiquidationRow, i believe that delegate call was meant to use.

Result of this is severe for the system. This means that all accumulated rewards will never be distributed to the users, which means loss of all yields for them.

Impact

Users loss yields.

Code Snippet

Provided above

Tool used

Manual Review

Recommendation

Make delegate call, or send funds to swapper and back.

Duplicate of #205