Vulnerability: Users can borrow funds, deposit them, then borrow more  Won't Fix
Severity: high

Description:
Users may deposit and borrow funds denominated in any asset supported by the `TokenRegistry`. Each time a user deposits or borrows a token, they earn FIN according to the difference in deposit / borrow rate indices maintained by `Bank`.\\nBorrowing funds\\nWhen users borrow funds, they may only borrow up to a certain amount: the user's “borrow power.” As long as the user is not requesting to borrow an amount that would cause their resulting borrowed asset value to exceed their available borrow power, the borrow is successful and the user receives the assets immediately. A user's borrow power is calculated in the following function:\\n```\\n/\\*\\*\\n \\* Calculate an account's borrow power based on token's LTV\\n \\*/\\nfunction getBorrowPower(address \\_borrower) public view returns (uint256 power) {\\n    for(uint8 i = 0; i < globalConfig.tokenInfoRegistry().getCoinLength(); i++) {\\n        if (isUserHasDeposits(\\_borrower, i)) {\\n            address token = globalConfig.tokenInfoRegistry().addressFromIndex(i);\\n            uint divisor = INT\\_UNIT;\\n            if(token != ETH\\_ADDR) {\\n                divisor = 10\\*\\*uint256(globalConfig.tokenInfoRegistry().getTokenDecimals(token));\\n            }\\n            // globalConfig.bank().newRateIndexCheckpoint(token);\\n            power = power.add(getDepositBalanceCurrent(token, \\_borrower)\\n                .mul(globalConfig.tokenInfoRegistry().priceFromIndex(i))\\n                .mul(globalConfig.tokenInfoRegistry().getBorrowLTV(token)).div(100)\\n                .div(divisor)\\n            );\\n        }\\n    }\\n    return power;\\n}\\n```\\n\\nFor each asset, borrow power is calculated from the user's deposit size, multiplied by the current chainlink price, multiplied and that asset's “borrow LTV.”\\nDepositing borrowed funds\\nAfter a user borrows tokens, they can then deposit those tokens, increasing their deposit balance for that asset. As a result, their borrow power increases, which allows the user to borrow again.\\nBy continuing to borrow, deposit, and borrow again, the user can repeatedly borrow assets. Essentially, this creates positions for the user where the collateral for their massive borrow position is entirely made up of borrowed assets.\\nConclusion\\nThere are several potential side-effects of this behavior.\\nFirst, as described in https://github.com/ConsenSys/definer-audit-2021-02/issues/3, the system is comprised of many different tokens, each of which is subject to price fluctuation. By borrowing and depositing repeatedly, a user may establish positions across all supported tokens. At this point, if price fluctuations cause the user's account to cross the liquidation threshold, their positions can be liquidated.\\nLiquidation is a complicated function of the protocol, but in essence, the liquidator purchases a target's collateral at a discount, and the resulting sale balances the account somewhat. However, when a user repeatedly deposits borrowed tokens, their collateral is made up of borrowed tokens: the system's liquidity! As a result, this may allow an attacker to intentionally create a massively over-leveraged account on purpose, liquidate it, and exit with a chunk of the system liquidity.\\nAnother potential problem with this behavior is FIN token mining. When users borrow and deposit, they earn FIN according to the size of the deposit / borrow, and the difference in deposit / borrow rate indices since the last deposit / borrow. By repeatedly depositing / borrowing, users are able to artificially deposit and borrow far more often than normal, which may allow them to generate FIN tokens at will. This additional strategy may make attacks like the one described above much more economically feasible.

Impact:

Recommended mitigation:
Due to the limited time available during this engagement, these possibilities and potential mitigations were not fully explored. Definer is encouraged to investigate this behavior more carefully.