A user can borrow DOLA interest-free. This requires the user to precisely manage their collateral. This issue might become especially troublesome if a Market is opened with some stablecoin as the collateral (because price fluctuations would become negligible and carefully managing collateral level would be easy).
This issue is harder to exploit (but not impossible) if gov takes responsibility for forcing replenishment, since gov has a stronger economic incentive than third parties.
Proof of Concept
If my calculations are correct, with the current gas prices it costs about \$5 to call Market.forceReplenish(...). Thus there is no economic incentive to do so as long as a debtor's DBR deficit is worth less than \$5/replenishmentIncentive so probably around \$100.
Borrow close to the maximum allowed amount of DOLA
Keep withdrawing or depositing collateral so that the collateral surplus does not exceed $100 (assuming current gas prices)
repay() their debt at any time in the future.
Withdraw all the collateral.
All this is possible with arbitrarily large DBR deficit because due to small collateral surplus at no point was it economical for a third party to forceReplenish() the user. If gov takes responsibility for forceReplenish()ing, the above procedure is still viable although the user has to maintain the collateral surplus at no more than around $5.
Tools Used
Manual review
Recommended Mitigation Steps
Allow replenishing to push the debt under the water and disallow repaying the debt with an outstanding DBR deficit. E.g.:
Lines of code
https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L567
Vulnerability details
Impact
A user can borrow DOLA interest-free. This requires the user to precisely manage their collateral. This issue might become especially troublesome if a Market is opened with some stablecoin as the collateral (because price fluctuations would become negligible and carefully managing collateral level would be easy).
This issue is harder to exploit (but not impossible) if
gov
takes responsibility for forcing replenishment, sincegov
has a stronger economic incentive than third parties.Proof of Concept
If my calculations are correct, with the current gas prices it costs about \$5 to call
Market.forceReplenish(...)
. Thus there is no economic incentive to do so as long as a debtor's DBR deficit is worth less than \$5/replenishmentIncentive
so probably around \$100.This is because replenishing cannot push a user's debt under the water (https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L567) and a user can repay their debt without having settled the DBR deficit (https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L531).
So, assuming the current prices, a user can:
repay()
their debt at any time in the future.All this is possible with arbitrarily large DBR deficit because due to small collateral surplus at no point was it economical for a third party to
forceReplenish()
the user. Ifgov
takes responsibility forforceReplenish()
ing, the above procedure is still viable although the user has to maintain the collateral surplus at no more than around $5.Tools Used
Manual review
Recommended Mitigation Steps
Allow replenishing to push the debt under the water and disallow repaying the debt with an outstanding DBR deficit. E.g.: