code-423n4 / 2021-04-vader-findings

1 stars 0 forks source link

_addDebtToMember and _removeDebtFromMember separately tracks debt and collateral #309

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

paulius.eth

Vulnerability details

Impact

Why functions _addDebtToMember and _removeDebtFromMember separately tracks debt and collateral? it is always the same: if the debt is increased, collateral is also increased, if the debt is decreased, collateral is also decreased. any particular reason to keep both of these variables that change together? function _addDebtToMember(address _member, uint _collateral, address _collateralAsset, uint _debt, address _debtAsset) internal { mapMember_Collateral[_member].mapCollateral_Debt[_collateralAsset].debt[_debtAsset] += _debt; mapMember_Collateral[_member].mapCollateral_Debt[_collateralAsset].collateral[_debtAsset] += _collateral; } function _removeDebtFromMember(address _member, uint _collateral, address _collateralAsset, uint _debt, address _debtAsset) internal { mapMember_Collateral[_member].mapCollateral_Debt[_collateralAsset].debt[_debtAsset] -= _debt; mapMember_Collateral[_member].mapCollateral_Debt[_collateralAsset].collateral[_debtAsset] -= _collateral; }

dmvt commented 3 years ago

The values are different so need to be tracked differently... unless I'm missing something, this is invalid