Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Description
Brief Description
There is a flaw in the implementation of the liquidity calculations for loans where the effective borrow value will be significantly undervalued for stable borrows. Specifically, the getLiquidity() function incorrectly calculates the effective borrow value due to a mistake in the order of indexes when calling balance.calcBorrowBalance(). The getLiquidity() function is crucial because it used at the end of functions that reduces user loan health (including withdraw) to check if loan is healthy .
Impact
Worst case scenario this bug could be used by attacker, to directly steal funds from the protocol, by undervaluing his debt(with accrued interest) and then withdraw a large portion of his collateral (see poc) however this requires enough time untill enough interest is accrued for the balance to be devalued enough for the attacker to be able to withdraw a large amount of his collateral and because of this we think the high severity is fair.
Description
The function calcStableBorrowBalance() is used in getLoanLiquidity() to calculate the effective borrowbalance of a userLoan if he has stable debt.
contracts/hub/logic/UserLoanLogic.sol
There is a bug in the order of parameter passed to calcBorrowBalance() leading to the balance being undervalued (Oldindex is divided by newIndex instead of the correct order)
Ran 1 test for test/pocs/forktest.t.sol:Pocs2[PASS] test_poc_02() (gas: 1329432)Logs: amount gained by withdrawal 7000 usdc amounts Bob stole 1999 usdcSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 524.96ms (11.99ms CPU time)Ran 1 test suite in 529.44ms (524.96ms CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests)
please first add the following file to test/pocs/base_test.sol