Assessment reports>Takara Lend Contracts>Discussion>Misleadingly named liquidatable global flag

Misleadingly named liquidatable global flag

In the Comptroller contract, the global boolean state variable liquidatable was implemented to control the functionality of the liquidation whitelist.

This variable is named in a misleading way. Users who rely on the common definition of the term "liquidatable" will assume, at the very least, that if the variable is true, then liquidations are more likely or more possible than if the variable were false.

However, what this variable actually controls is whether the liquidation process is whitelisted:

function liquidateBorrowAllowed(
    // [...]
) external view override returns (uint256) {
    if (liquidatable && !liquidatorWhiteList[liquidator]) {
        return uint256(Error.UNAUTHORIZED);
    }

    // [...]

This means that if the flag is true, then only liquidators in the liquidatorWhiteList may liquidate positions, and if the flag is false, then the whitelist is disabled and anyone can liquidate positions. So, liquidatable being false strictly increases the possibility of liquidations.

We recommend renaming this variable to liquidatorWhiteListEnabled in order to reflect the actual purpose of this flag.

Zellic © 2025Back to top ↑