PT-2021-24473 · Unknown · Liquity Protocol

Published 2021-08-05 · Updated 2021-08-05

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Liquity protocol (affected versions not specified)

Description: A temporary miscalculation of the Total Collateral Ratio (TCR) occurs in the batchLiquidateTroves function during Recovery Mode. The issue arises from the incorrect calculation of the system's entire collateral, which should exclude the liquidated trove's surplus collateral. This miscalculation can negatively impact liquidation throughput and gas efficiency gains from batching multiple liquidations in a single transaction. However, the impact is only significant in a very narrow set of circumstances, where the resulting real TCR is close to the Recovery Mode boundary. The potential effects of the bug include premature exit from Recovery Mode, incorrect liquidation of troves, and redistribution of offsets against the Stability Pool.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-682

Related Identifiers

GHSA-XH2P-7P87-FHGH

Affected Products

Liquity Protocol

References · 5

• https://osv.dev/vulnerability/GHSA-xh2p-7p87-fhgh · Vendor Advisory
• https://github.com/liquity/dev/commit/c69d0bae30b5457e89724d880851a03ba7477905 · Note
• https://github.com/liquity/dev/security/advisories/GHSA-xh2p-7p87-fhgh · Note
• https://github.com/liquity/dev/blob/7c83ea11378454629618b3808b16fbfda69ee3e5/packages/contracts/contracts/TroveManager.sol#L722 · Note
• https://npmjs.com/package/@liquity/contracts · Note