GalloDaSballo / Apollon-Review

Notes for the Apollon Solo Security Review
0 stars 0 forks source link

`claimUnassignedAsset` `_percentage` can be more than 1e18 #56

Open GalloDaSballo opened 3 months ago

GalloDaSballo commented 3 months ago

Impact

https://github.com/blkswnStudio/ap/blob/8fab2b32b4f55efd92819bd1d0da9bed4b339e87/packages/contracts/contracts/BorrowerOperations.sol#L614-L620

  function claimUnassignedAssets(
    uint _percentage,
    address _upperHint,
    address _lowerHint,
    bytes[] memory _priceUpdateData
  ) external payable override {
    if (_percentage == 0) revert ZeroDebtChange();

Maybe abused for exploit, I haven't spent a lot of time on this, it's best to cap it to 1e18 to avoid any additional risk

Mitigation

if (_percentage > DECIMAL_PRECISION) revert Above100Pct();
sambP commented 2 months ago
Screenshot 2024-08-28 at 10 04 30 PM