035.md

Breezy Basil Toad

Medium

all attempts to repay will fail when borrow balance exceeds collateral amount

Summary

The deleverToZeroBalance function pays down the borrow token to zero by selling off a specified amount of the collateral asset. The function first borrows collateral, then trades the collateral for borrow tokens, and finally repays the debt position. However, if, due to extreme market conditions, the borrow balance exceeds or is equal to the collateral balance, all attempts to withdraw and repay will fail. Currently, there is no function to account for this situation. As a result, whenever the borrow balance exceeds the collateral, the position will be liquidated, as all withdrawals for collateral will be blocked as a result the debt position will be liquidated

Root Cause

https://github.com/sherlock-audit/2024-10-morpho-x-index/blob/2f125406e0dd3b1fc029b9a47fe97bfbf906fce2/index-protocol/contracts/protocol/modules/v1/MorphoLeverageModule.sol#L247C3-L293C24

Internal pre-conditions

No response

External pre-conditions

borrowposition more than or equal to collateral

Attack Path

No response

Impact

The position will be liquidated every time the collateral is equal to or less than the borrow balance.

PoC

No response

Mitigation

Consider a design change to handle the case when the collateral drops to the liquidation threshold