Closed code423n4 closed 2 years ago
WatchPug
https://github.com/code-423n4/2021-09-wildcredit/blob/c48235289a25b2134bb16530185483e8c85507f8/contracts/LendingPair.sol#L660-L684
In _supplyCreditUni(), the calculation of the collateral value of tokenB supply is using _priceB instead of _priceA, which can lead to undercollateralized loans.
_supplyCreditUni()
_priceB
_priceA
function _supplyCreditUni( address _account, address _returnToken, uint _priceA, uint _priceB, uint _colFactorA, uint _colFactorB ) internal view returns(uint) { if (uniPosition[_account] > 0) { (uint amountA, uint amountB) = uniV3Helper.positionAmounts(uniPosition[_account], _priceA, _priceB); uint supplyA = _convertTokenValues(tokenA, _returnToken, amountA, _priceA, _priceB); uint supplyB = _convertTokenValues(tokenB, _returnToken, amountB, _priceB, _priceB); uint creditA = supplyA * _colFactorA / 100e18; uint creditB = supplyB * _colFactorB / 100e18; return (creditA + creditB); } else { return 0; } }
Undercollateralized debts cannot be liquidated and it leads to bad debts to the protocol.
An attacker can deposit a small sum of collateral asset and borrow a rather large amount of asset, essentially steal funds from the protocol.
Given:
An attacker can:
The attacker steals ~399.9 BTC from the protocol.
Consider changing to:
uint supplyB = _convertTokenValues(tokenB, _returnToken, amountB, _priceB, _priceA);
Duplicate #70
Handle
WatchPug
Vulnerability details
https://github.com/code-423n4/2021-09-wildcredit/blob/c48235289a25b2134bb16530185483e8c85507f8/contracts/LendingPair.sol#L660-L684
In
_supplyCreditUni()
, the calculation of the collateral value of tokenB supply is using_priceB
instead of_priceA
, which can lead to undercollateralized loans.Impact
Undercollateralized debts cannot be liquidated and it leads to bad debts to the protocol.
An attacker can deposit a small sum of collateral asset and borrow a rather large amount of asset, essentially steal funds from the protocol.
Proof of Concept
Given:
An attacker can:
The attacker steals ~399.9 BTC from the protocol.
Recommendation
Consider changing to: