Protocol lacks any logic for bad debt socialization which allows _malicious_ tech savvy users to game honest users on the platform since this leads to a _bank-run_ like situation

[c4-bot-6]

Lines of code

https://github.com/code-423n4/2024-05-predy/blob/a9246db5f874a91fb71c296aac6a66902289306a/src/libraries/logic/LiquidationLogic.sol#L57
https://github.com/code-423n4/2024-05-predy/blob/a9246db5f874a91fb71c296aac6a66902289306a/src/libraries/logic/LiquidationLogic.sol#L142

Vulnerability details

Proof of Concept

Currently protocol does not integrate a bad debt socialisation method in regards to vaults that are in the danger zone and then end up being liquidatable.

Note that it's common around DEFI logic that a liquidatable position could generate bad debt, which is debt that will never be repaid by anyone, even if fully liquidated. Normally and advisably, when this happens, the loss is socialized among all suppliers equally. i.e this defines what bad debt socialisation itself is, since the logic around it is that when the price of an asset drops massively and say users are in the market, while liquidating now the original price of assets is no longer held and these bad debt is socialised among holders. Now since the generated debt is not been socialised among all participants until the full amount is repaid.

This then allows for a liquidator to game the system by using a flashloan to to liquidate all but one sufficient asset that would cover all the bad debt protocol has engulfed, withdraw his stake from the protocol fully, this way he has sidelined the loss from the bad debt.

Impact

Protocol and users would be left with no way to deal with bad debt, considering it's not being socialised amongst users, providing incentives for a bank-run like ideology in users, as once users see that the tracked balance and the real amount of assets in protocol's control does not match they try to withdraw their stake from the protocol which leads to the last set of users not being able to withdraw cause protocol would not have enough assets to cover these withdrawals.

Recommended Mitigation Steps

Consider integrating a bad debt socialisation method.

Assessed type

Context

[Bauchibred]

HI @alex-ppg, thanks for judging, pinging so you can give a quick review on this as I believe the point raised in the report to be valid.

[alex-ppg]

Hey @Bauchibred, thank you for the ping! I do not believe the submission is a sufficient HM vulnerability and instead describes a systemic risk with these types of protocols and a proposed way to mitigate it that is very broad and non-specific. As such, this submission will remain in the validation repository.