No minLoanSize means liquidators will have no incentive to liquidate small positions

[c4-bot-4]

Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L550-L602

Vulnerability details

Summary

No minLoanSize can destabilise the protocol

Vulnerability Details

According to protocol team they plan to roll out the protocol with minLoanSize = 0 and adjust that number if needs be.
This can be a big issue because there will be no incentive for liquidators to liquidate small underwater positions given the gas cost to do so would not make economic sense based on the incentive they would receive.
It also opens up a cheap attack path for would be attackers whereby they can borrow many small loans which will go underwater as they accrue interest but will not be liquidated.

Impact

Can push the entire protocol into an underwater state.
Underwater debt would first be covered by Protocol reserves and where they arent sufficient, lenders will bear the responsibility of the uneconomical clean up of bad debt so both the protocol and lenders stand to lose out.

Tools Used

Manual Review

Recommendations

Close the vulnerability by implementing a relaistic minLoanSize which will incentivise liquidators to clean up bad debt.

Assessed type

Other

[c4-pre-sort]

0xEVom marked the issue as sufficient quality report

[c4-pre-sort]

0xEVom marked the issue as primary issue

[c4-sponsor]

kalinbas (sponsor) acknowledged

[kalinbas]

Will do the deployment with a reasonable minLoanSize.

[jhsagd76]

Normally, I would mark such issues as Low. But given that this issue provides a substantial reminder to the sponsor, I am retaining it as an M.

Further solicit opinion from the sponsor and may downgrade it to an L.

[c4-judge]

jhsagd76 marked the issue as satisfactory

[c4-judge]

jhsagd76 marked the issue as selected for report