Micro Neon Beaver - Migrator Fails to Migrate Borrow-Only Positions Not Used as Collateral

[sherlock-admin2]

Micro Neon Beaver

Medium

Migrator Fails to Migrate Borrow-Only Positions Not Used as Collateral

Summary

Migrator skips borrow positions from markets not entered as collateral, leaving those specific debt positions unmigrated while other positions migrate successfully

Root Cause

The _collectMendiPositions function in Migrator.sol:165 uses getAssetsIn() which only returns markets the user has entered as collateral. Users who borrowed without entering the market (not using it as collateral) are excluded from migration, leaving their debt positions stranded.

Internal Pre-conditions

1. User has borrowed from a Mendi market
2. User has NOT entered that market (not using as collateral)
3. User attempts migration

External Pre-conditions

None.

Attack Path

1. User deposits WETH and enters it as collateral
2. User borrows USDC but doesn't enter USDC market (valid in Compound forks)
3. User calls migrate()
4. WETH position migrates (in getAssetsIn())
5. USDC borrow position NOT migrated (not in getAssetsIn())
6. Result: WETH collateral on Malda, USDC debt remains on Mendi
7. Split position across two protocols

Impact

Incomplete migration causing split positions across protocols. Specific borrow positions from non-entered markets remain on Mendi while other positions migrate to Malda. Users must manually manage positions on both protocols, increasing complexity and liquidation risk.

PoC

.

Mitigation

Iterate through all markets, not just entered ones:

function _collectMendiPositions(address user) private returns (Position[] memory) {
    // Get ALL markets, not just entered
    address[] memory allMarkets = IMendiComptroller(MENDI_COMPTROLLER).getAllMarkets();
    
    for (uint256 i = 0; i < allMarkets.length; i++) {
        uint256 borrowAmount = IMendiMarket(allMarkets[i]).borrowBalanceStored(user);
        if (borrowAmount > 0) {
            // Include even if not entered as collateral
        }
    }
}