When liquidate bad loan, protocol does not pay out of reserve as intended and only pay out of lender pocket. Missing update exchangeRate after bad loan calculation.
Audit: 2024-03-revert-lend-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L1123-L1141


# Vulnerability details



[Quoting comment](https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L1087-L1090) from `V3Vault.sol` on how liquidation work:

> // calculates amount which needs to be payed to liquidate position
> //  if position is too valuable - not all of the position is liquididated - only needed amount
> //  if position is not valuable enough - missing part is covered by reserves - if not enough reserves - collectively by other borrowers

This part `if position is not valuable enough - missing part is covered by reserves` is not true. When bad loan happen and collateral not enough to repay debt (original borrow + interest).

The debt have never been 100% repaid or write off. Exchange rate (borrowIndex,SupplyIndex) stay the same. The pool still consider debt have been fully repaid while no USDC have been deposited to the pool or taken from somewhere to cover entire 100% debt.

## Impact

Wrong handling of liquidation of really bad loan.
A chunk of debt never repaid and no money taken out of anywhere to compensate for it and no exchange rate have been updated to reflect this.

Causing wrong calculation for global debt, exchange rate. This mean not all future lenders can take out their correct share worth in USDC.

## Proof of Concept

With current implementation of `V3Vault.sol`.
Here is simplified stuff happen when calculate liquidation of bad loan:

- Check loan is healthy or not
- calculate how much need to be liquidated
- how much USDC token need to repay debt
- how much portion of NFT liquidated to send to liquidator
- how much portion of NFT liquidated to send to original borrower
- how much USDC token need to take out of pool to compensate if loan is really bad.

### When collateral is worth more than debt

Liquidator pay full debt and receive ~110% value of debt in collateral.
<https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L1103-L1111>

### When collateral is worth less than debt

<https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L1112-L1118>

```solidity
    // all position value. //@fullValue is just NFT collateral worth in USDC
    liquidationValue = fullValue; //@ fullvalue < maxPenaltyValue < debt * 110%
    
    uint256 penaltyValue = fullValue * (Q32 - MAX_LIQUIDATION_PENALTY_X32) / Q32;//@full value * 90% 
    liquidatorCost = penaltyValue;
    reserveCost = debt - penaltyValue;//penaltyValue = fullValue * 90%.         
```

Liquidator will pay 90% of NFT value in USDC and get whole NFT positions in return.
The rest of debt suppose to be taken from reserve.

[Taking money out of reserve function here](https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894