057.md

Decent Sepia Caterpillar

High

pending quotes and balances for Party B are not cleared

Summary

The liquidatePartyB() function uses delete quoteLayout.partyBPendingQuotes[partyB][partyA] to clear pending quotes and reset balances, but these operations do not fully reset nested mappings within the Layout struct. The delete operation doesn't traverse through nested mappings as it lacks key set information

Root Cause

https://github.com/sherlock-audit/2024-09-symmio-v0-8-4-update-contest/blob/main/protocol-core/contracts/libraries/LibLiquidation.sol#L77

Solidity's delete keyword when dealing with complex data structures, particularly nested mappings within structs. The delete operation does not recursively clear all nested elements.

However, the function liquidatePartyB() uses the delete to reset liquidator state which is a nested mappings within the Layout struct .

Other instances : https://github.com/sherlock-audit/2024-09-symmio-v0-8-4-update-contest/blob/main/protocol-core/contracts/facets/liquidation/LiquidationFacetImpl.sol#L294

https://github.com/sherlock-audit/2024-09-symmio-v0-8-4-update-contest/blob/main/protocol-core/contracts/facets/liquidation/LiquidationFacetImpl.sol#L104

https://github.com/sherlock-audit/2024-09-symmio-v0-8-4-update-contest/blob/main/protocol-core/contracts/facets/liquidation/LiquidationFacetImpl.sol#L115

https://github.com/sherlock-audit/2024-09-symmio-v0-8-4-update-contest/blob/main/protocol-core/contracts/facets/liquidation/LiquidationFacetImpl.sol#L309

https://github.com/sherlock-audit/2024-09-symmio-v0-8-4-update-contest/blob/main/protocol-core/contracts/facets/liquidation/LiquidationFacetImpl.sol#L310

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

pending quotes and balances for Party B will not be cleared or reset

PoC

No response

Mitigation

Ensure that pending quotes and balances for Party B are cleared