Audit Lending

Lending & Borrowing Auditor

When to Use

• Auditing lending/borrowing protocols, collateral management systems
• User mentions: lending, borrowing, liquidation, collateral, loan, repayment, refinancing, debt, grace period, pause mechanism
• Analyzing loan lifecycle: creation, repayment, liquidation, refinancing
• Reviewing collateral tracking, debt calculations, pause/unpause operations

Audit Workflow

IMPORTANT: Announce skill usage at the start of analysis

Begin with: "I'm using the audit-lending skill to analyze this contract for lending and borrowing protocol vulnerabilities..."

1. Scan for lending operations

   • Search: liquidate, repay, borrow, collateral, loan, refinance, close, pause, unpause
   • Focus: liquidation conditions, collateral management, debt tracking, pause mechanisms

2. Check against vulnerability patterns

   • Reference reference.md for complete checklist
   • Compare code against example.md

3. Validate exploitability

   • Check access control first - grep for onlyOwner|onlyAdmin|onlyGovernance modifiers
   • Can non-privileged actors exploit lending vulnerabilities?
   • Can borrower avoid liquidation?
   • Can attacker grief lenders/borrowers?
   • Can loan state be corrupted?
   • Verify no compensating protections exist
   • Downgrade severity if admin-only unless direct user fund impact

4. Generate report

   • Use deliverable template below
   • Include PoC for each finding
   • Rank by severity

Core Vulnerability Patterns

See reference.md for full checklist. Key patterns:

1. Liquidation before default → borrowers unfairly liquidated early
2. Collateral manipulation → prevents liquidation entirely
3. Loan closure without repayment → debt written off
4. Asymmetric pause mechanism → repayments paused, liquidations active
5. Token disallow blocks existing operations → repayments/liquidations fail
6. No grace period after unpause → immediate unfair liquidations
7. Incorrect liquidation shares → collateral drained with partial repayment
8. Repayments to zero address → funds burned
9. Forced loan assignment → unwilling lenders receive loans
10. Loan state manipulation → auction cancellation extends loans indefinitely
11. Double debt subtraction → pool balance corrupted
12. Dust loan griefing → bypass minLoanSize to force small loans

Code examples: See example.md

Severity Criteria

Critical: Fund loss, collateral theft, debt erasure without repayment, pool insolvency, MUST be exploitable by non-privileged actors High: Unfair liquidation, griefing preventing operations, loan state corruption enabling extended default, MUST be exploitable by non-privileged actors Medium: Edge case timing issues, suboptimal pause mechanisms, dust attacks with limited impact, admin-only lending configuration issues with cascading user impact Low: Inefficient implementations without security impact, admin-only parameter issues without immediate user impact

IMPORTANT: Admin-only lending functions (onlyOwner, onlyAdmin, onlyGovernance) are MEDIUM or LOW severity unless:

• Invalid parameters directly enable borrowers to avoid repayment or liquidation
• Missing validation enables admin to steal user collateral or erase debt without authorization
• Pause mechanism asymmetry (admin pauses repayments but not liquidations) directly harms borrowers

False Positives - Do NOT Flag

• Liquidation timing with documented grace periods
• Admin-only token disallow for new loans (not affecting existing)
• Intentional minimum loan sizes with explicit documentation
• Refinancing with proper accounting checks
• Pause mechanisms affecting both repayment and liquidation symmetrically
• Admin-only collateral configuration functions (onlyOwner, onlyAdmin) with documented trust assumptions
• Governance-controlled loan parameter updates with timelock allowing users to exit
• Admin functions for emergency pause where both repayment and liquidation are halted symmetrically

Deliverable Format

MANDATORY: Before deliverable, verify each checklist.md item against codebase. Flag violations as findings.

Use template: templates/report-template.md

Each finding includes: severity, pattern #, file/lines, description, vulnerable code, impact analysis, PoC showing exploitation, remediation, gas impact.

Key Principles

• Grace periods - borrowers need reasonable time after defaults/unpauses
• Symmetric pauses - pause repayments → pause liquidations
• Collateral integrity - cannot be zeroed or manipulated post-creation
• Accurate accounting - debt tracking must be atomic and correct
• Minimum viability - enforce minimums to prevent griefing

Output Guidelines

DO:

• Reference specific lines and functions
• Provide executable PoCs showing fund loss or griefing
• Quantify impact (funds at risk, borrowers affected)
• Show timing calculations for liquidation conditions

DON'T:

• Report intentional design choices with documentation
• Flag gas optimizations without exploit path
• Use vague terms ("could be vulnerable")
• Ignore context (grace periods elsewhere, admin controls)