Loss of NFTs via underflow on seizeAmount

[code423n4]

Lines of code

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/CToken.sol#L1090-L1092

Vulnerability details

Issue: seizeAmounts[] > seizeTokens, seizeTokens will underflow because of solidity 5. Underflow allows an illegitimate amount of NFTs to be seized.

Consequence: If a user's borrow health drops to allow legitimate liquidation, an attacker can seize their ERC-1155 collateral for free.

Proof of Concept

• A user has two tokens in the pool, ids 1 & 2, with amount of each as 1
• attacker calls liquidateBorrowNft on a cToken CErc20.sol#L126
• Attacker sets seizeAmounts = [type(uint256).max, 1] and siezeIds = [1,2],repayAmount` set to 0
• internal liquidateBorrowNftFresh calls comptroller.liquidateBorrowAllowed Comptroller.sol#L403
• If the liquidation is legitimate, the liquidateBorrowAllowed passes and the call chain goes back to the cToken
• comptroller.liquidateCalculateSeizeNfts is called, will return siezeTokens = 0 as repayAmount = 0
• Call chain passes back to cToken
• First step of seizeTokens -= seizeAmounts[i] underflows seizeTokens from 0 to 1 CToken.sol#L1090-L1092
• Second step reduces seizeTokens from 1 to 0.
• require(seizeTokens == 0) check passes
• cNft.seize is called
• cNFT must be for ERC-1155 collateral or the require(seizeAmounts[i] == 1 check will fail
• internal _safeBatchTransferFrom will succeed as it has no balance checks
• End result: attacker will have [type(uint256).max, 1] cNft tokens, obtained for free.

Mitigations

Mitigation: Use safeMath for seizeTokens -= seizeAmounts[i]

[bunkerfinance-dev]

While there is an underflow possibility that we should check for (it wouldn't hurt), I can't see how this can result in losing funds. repayAmount cannot be equal to 0 (see this line)

[gzeoneth]

Invalid because CNft is compiled with ^0.8.0 and seizeAmounts = [type(uint256).max, 1] would lead to overflow in totalAmount += amounts[i];

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/CNft.sol#L2-L3

pragma solidity ^0.8.0;

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/CNft.sol#L49-L54

        uint256 totalAmount = 0;
        for (uint256 i; i < length; ++i) {
            if (!is1155) {
                require(amounts[i] == 1, "CNFT: Amounts must be all 1s for non-ERC1155s.");
            }
            totalAmount += amounts[i];