The liquidator can partially liquidate loans at the edge of the borrowed amount and eat up all the collateral because of the liquidation bonus. This will cause the borrowed position to lose almost all the available collateral and there will still be a significant amount of loan that cannot be covered, resulting in the bad debt for the protocol.
Vulnerability Details
The protocol allows partial liquidation of the loans, there is also a liquidation bonus for the liquidator which is calculated based on the liquidation amount, and the liquidation bonus is paid from the remaining collateral. Liquidator can take advantage of this by liquidating 96% of loans and booking the remaining as a profit leading to bad debt for the protocol.
Attack Flow
Alice borrow 1000 USDC by providing 1 ETH at 3000$
After some time the interest is 47 USDC so total loan is now 1047 USDC
Now the ETH price suddenly tanks to 1000 $
Liquidator will liquidate 960 USDC amount
Liquidation Bonus will be 38.5USDC worth ETH from borrower’s collateral
Remaining debt will be 1047 - 960 = 87 USDC
Remaining collateral value will be 1.5$
Impact Details
The protocol will incur bad debt and can lead to insolvency.