cducrest-brainbot - Racing condition in between repaying and liquidating a debt when repay was not allowed

[sherlock-admin]

cducrest-brainbot

medium

Racing condition in between repaying and liquidating a debt when repay was not allowed

Summary

The selected fix to sherlock-audit/2023-02-blueberry-judging#290 was to prevent liquidation when repay is not allowed. This introduces a racing condition when repay is not allowed, positions become liquidateable, and repay is again allowed. Liquidators and position owners will race to repay / liquidate the position.

Vulnerability Detail

Both liquidation and repayment are not allowed when the admin of BlueBerryBank disables repayment:

    function liquidate(
        uint256 positionId,
        address debtToken,
        uint256 amountCall
    ) external override lock poke(debtToken) {
        if (!isRepayAllowed()) revert Errors.REPAY_NOT_ALLOWED();
        ...
    }

    function repay(
        address token,
        uint256 amountCall
    ) external override inExec poke(token) onlyWhitelistedToken(token) {
        if (!isRepayAllowed()) revert Errors.REPAY_NOT_ALLOWED();
        ...
    }

There is no means to allow repayment and prevent liquidation for a time.

Impact

While repayment is not allowed, positions can become liquidateable. When admin re-enable repayments, the owner of the position risks liquidation without having a chance to repay its position if liquidator are faster to the chain than repayer. This is highly likely as liquidator are probably automated tools while repayers are human users.

Code Snippet

https://github.com/sherlock-audit/2023-04-blueberry/blob/96eb1829571dc46e1a387985bd56989702c5e1dc/blueberry-core/contracts/BlueBerryBank.sol#L487-L492

https://github.com/sherlock-audit/2023-04-blueberry/blob/96eb1829571dc46e1a387985bd56989702c5e1dc/blueberry-core/contracts/BlueBerryBank.sol#L718-L722

Tool used

Manual Review

Recommendation

Allow reactivation of repayments without activating liquidation to give time to users to repay their position and not be liquidated. Alternatively do not disable repayments.

Duplicate of #117