When the LendingPool borrowing rate is too high, _rebalance could revert

[code423n4]

Lines of code

https://github.com/code-423n4/2023-02-ethos/blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos-Core/contracts/ActivePool.sol#L239

Vulnerability details

Impact

If the vault is withdrawing from the strategy and the lendingPool doesn't have enough amount to withdraw, due to excessive borrowing, withdrawals will stop working.

This will make _rebalance revert, which in turn will cause:

• Inability to Redeem
• Inability to Liquidate

Both of those functions are meant to reduce risk to the system, meaning that in cases of reverts, the system may forcefully end up in bad-debt as liquidators and redeemers will be unable to perform their function.

See this quote:

As U gets closer to 100%, the capital becomes scarcer until no liquidity is left at U=100%. This situation can be problematic if depositors wish to withdraw their liquidity, but no funds are available.

From this article

Additional Note

I sent a High Exploiting this:
Denial of liquidations and Redemptions by overborrowing

Consider keeping them separate as the "exploit vs no exploit findings"

Remediation

Allowing to draw from the capital available can offer partial relief

However if the capital to withdraw is high enough, then the system will eventually start reverting as you cannot assume that the pool can be withdrawn from at all times

[trust1995]

Same root cause as #693 , will dup.

[c4-judge]

trust1995 marked the issue as duplicate of #693

[c4-judge]

trust1995 marked the issue as satisfactory