0x52 - Outstanding loans cannot be closed or liquidated if collateral is paused

[github-actions]

0x52

high

Outstanding loans cannot be closed or liquidated if collateral is paused

Summary

When a collateral is paused by governance, collateralValid is set to false. This causes closing and liquidating of loans to be impossible, leading to two issues. The first is that users with exist loans are unable to close their loans to recover their collateral. The second is that since debt is impossible to liquidate the protocol could end up being stuck with a lot of bad debt.

Vulnerability Detail

function pauseCollateralType(
    address _collateralAddress,
    bytes32 _currencyKey
    ) external collateralExists(_collateralAddress) onlyAdmin {
    require(_collateralAddress != address(0)); //this should get caught by the collateralExists check but just to be careful
    //checks two inputs to help prevent input mistakes
    require( _currencyKey == collateralProps[_collateralAddress].currencyKey, "Mismatched data");
    collateralValid[_collateralAddress] = false;
    collateralPaused[_collateralAddress] = true;
}

When a collateral is paused collateralValid[_collateralAddress] is set to false. For Vault_Lyra Vault_Synths and Vault_Velo this will cause closeLoan and callLiquidation to revert. This traps existing users and prevents liquidations which will result in bad debt for the protocol

Impact

Outstanding loans cannot be closed or liquidated, freezing user funds and causing the protocol to take on bad debt

Code Snippet

https://github.com/sherlock-audit/2022-11-isomorph/blob/main/contracts/Isomorph/contracts/CollateralBook.sol#L185-L195

Tool used

Manual Review

Recommendation

Allow liquidations and loan closure when collateral is paused

[kree-dotcom]

Fixed. kree-dotcom/isomorph@9fef842

By decoupling the switching of the CollateralValid mapping in the CollateralBook.sol from CollateralPaused we can now introduce an additional check in OpenLoan() of require(!collateralBook.collateralPaused(_collateralAddress), "Paused collateral!");
This means increaseCollateralAmount(), closeLoan() and callLiquidation() can all occur for paused collaterals.

[IAm0x52]

Fixes look good. Pausing collateral no longer marks the collateral as invalid, allowing vault actions to be carried out when collateral is paused. OpenLoan now reverts if collateral is paused.