cergyk - A partyA/B can Dos own liquidation because liquidation relies on a nonced signature

[sherlock-admin]

cergyk

high

A partyA/B can Dos own liquidation because liquidation relies on a nonced signature

Summary

A partyA can Dos own liquidation because liquidation relies on a nonced signature.

Vulnerability Detail

We can see that liquidation for partyA relies on a nonced signature, which is fetched directly from the on-chain value:
https://github.com/sherlock-audit/2023-06-symmetrical/blob/main/symmio-core/contracts/facets/liquidation/LiquidationFacetImpl.sol#L23

https://github.com/sherlock-audit/2023-06-symmetrical/blob/main/symmio-core/contracts/libraries/LibMuon.sol#L87-L106

however, since partyA can increment this value indefinitely by allocating or deallocating a small amount:
https://github.com/sherlock-audit/2023-06-symmetrical/blob/main/symmio-core/contracts/facets/Account/AccountFacetImpl.sol#L41-L52

partyA can prevent a liquidator to ever have a valid signature to proceed with the liquidation by doing one of these operations at every block.

Note that a partyB can Dos its own liquidation in a similar way since it relies on a signature of AccountStorage.layout().partyBNonces[partyB][partyA], which can be incremented by allocating/deallocating:
https://github.com/sherlock-audit/2023-06-symmetrical/blob/main/symmio-core/contracts/facets/Account/AccountFacetImpl.sol#L119-L132

Impact

partyA or partyB can prevent its own liquidation indefinitely and thus increase deficit of the protocol

Code Snippet

Tool used

Manual Review

Recommendation

Check if partyA, partyB is liquidatable (!= liquidating, which is already checked) for any operation incrementing its nonce

Duplicate of #233