Executive brief
Liquity is a decentralized borrowing protocol that allows users to take loans backed by cryptocurrency collateral. A calculation bug in the batch liquidation function temporarily miscalculates the Total Collateral Ratio (TCR) during Recovery Mode, potentially causing the system to exit Recovery Mode prematurely and liquidate troves that should not be liquidated. This could expose stability providers to losses that should otherwise be borne by borrowers, though the impact occurs only in narrow, specific circumstances with particular market and transaction ordering conditions.
Technical details
The vulnerability is an incorrect arithmetic calculation in the batchLiquidateTroves() function within TroveManager.sol. When computing the system's entire collateral during batch liquidation in Recovery Mode, the function fails to exclude the liquidated trove's surplus collateral, which should be removed from the calculation since liquidation makes that surplus claimable by the trove owner. This temporary miscalculation causes the TCR check to be inaccurate for the duration of the transaction. The bug requires a specific set of preconditions: the system must be in Recovery Mode with TCR near the 150% boundary (within 0.53% margin for a 1% collateral trove), and liquidations must be ordered in a particular sequence to trigger the distortion. No authentication is required; the attack vector is network-based. Once the transaction completes, the TCR is recalculated correctly. No mainnet patch has been deployed due to the protocol's immutability and the low severity of the issue.
Affected products
- Liquity contracts 1.0.0 and earlier
Timeline
- 2021-07-09: disclosed
- 2021-08-05: advisory