Closed code423n4 closed 2 years ago
While this report is true, I would not consider this a bug because of three reasons:
It is common for long dated fixed income instruments to be illiquid for periods of time, this is simply the nature of the product.
Lines of code
https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashBase.sol#L39
Vulnerability details
What is idiosyncratic fCash?
Cited from here.
Impact
To unwrap idiosyncratic wfCash tokens (non-tradable wrapped fCash), a smart contract (which does not implement
IERC1155TokenReceiver
) has to wait for the wfCash tokens to reach maturity.One of the consequences of being "stuck" with wrapped fCash tokens is that wrapped fCash can not be used as collateral for borrowing on Notional. Hence, not being able to unwrap fCash restricts the holder.
Proof of Concept
Consider a given contract (which does not implement
IERC1155TokenReceiver
) and the following scenario:The contract owns idiosyncratic fCash tokens (not matured)
Contract transfers those fCash tokens to wfCash contract,
wfCashLogic.onERC1155Received
receive hook is called and "wraps" received fCash tokens (minting)Sender contract receives wrapped fCash tokens
Now the contract tries to unwrap fCash tokens again (prior to maturity) by using any of the following functions:
wfCashLogic.redeem
wfCashLogic.redeemToAsset
wfCashLogic.redeemToUnderlying
wfCashERC4626.withdraw
wfCashERC4626.redeem
All above-mentioned functions call
wfCashLogic._burn
internally. However, due to the following 2 possible issues, the function reverts:Issue #1
If the
wfCashLogic._burn
function is called withopts.transferfCash = false
(false
is used by default), the firstif
branch is skipped (fCash is not matured) and the 3rd branch is executed. Due to_sellfCash
not being able to trade idiosyncratic fCash, this will revert.wfCashLogic.sol#L249-L256
Notional - CashGroup.loadMarket
Issue #2
If the
wfCashLogic._burn
function is called withopts.transferfCash = true
andopts.receiver
set to the contract address (by usingwfCashLogic.redeem
), the firstif
branch is skipped (fCash is not matured) and the 2nd branch is executed. As the contract does not implementIERC1155TokenReceiver
and is missing theonERC1155Received
hook, this will revert.Notional - ERC1155Action.sol#L182-L188
Tools Used
Manual review
Recommended mitigation steps
Consider preventing wrapped idiosyncratic fCash tokens in wfCashBase.sol#L39 by checking
marketIndex
andisIdiosyncratic
inwfCashBase.initialize
while initializing a fCash wrapper contract.