0x52 - _calculateMaxBorrowCollateral calculates repay incorrectly and can lead to set token liquidation

[sherlock-admin]

0x52

high

_calculateMaxBorrowCollateral calculates repay incorrectly and can lead to set token liquidation

Summary

When calculating the amount to repay, _calculateMaxBorrowCollateral incorrectly applies unutilizedLeveragePercentage when calculating netRepayLimit. The result is that if the borrowValue ever exceeds liquidationThreshold * (1 - unutilizedLeveragPercentage) then all attempts to repay will revert.

Vulnerability Detail

AaveLeverageStrategyExtension.sol#L1110-L1118

    } else {
        uint256 netRepayLimit = _actionInfo.collateralValue
            .preciseMul(liquidationThresholdRaw.mul(10 ** 14))
            .preciseMul(PreciseUnitMath.preciseUnit().sub(execution.unutilizedLeveragePercentage));

        return _actionInfo.collateralBalance
            .preciseMul(netRepayLimit.sub(_actionInfo.borrowValue))
            .preciseDiv(netRepayLimit);
    }

When calculating netRepayLimit, _calculateMaxBorrowCollateral uses the liquidationThreshold adjusted by unutilizedLeveragePercentage. It then subtracts the borrow value from this limit. This is problematic because if the current borrowValue of the set token exceeds liquidationThreshold * (1 - unutilizedLeveragPercentage) then this line will revert making it impossible to make any kind of repayment. Once no repayment is possible the set token can't rebalance and will be liquidated.

Impact

Once the leverage exceeds a certain point the set token can no longer rebalance

Code Snippet

AaveLeverageStrategyExtension.sol#L1110-L1118

Tool used

Manual Review

Recommendation

Don't adjust the max value by unutilizedLeveragPercentage

[pblivin0x]

The outlined issue and fix LGTM. We need to loosen the performed netRepayLimit check to avoid the case where we have high leverage and can't submit repayment (borrowValue > liquidationThreshold * (1 - unutilizedLeveragPercentage))

[ckoopmann]

Fixed in the below PR by removing the unutilizedLeveragPercentage adjustment as suggested:
IndexCoop/index-coop-smart-contracts#142

[IAm0x52]

Fix looks good. unutilizedLeveragePercentage is no longer used when calculating net repay