Open code423n4 opened 1 year ago
This seems to be a design choice. The user should perhaps be allowed to repay his debt without penalty if he does so quickly enough. That is, if forced replenishment is designed as a threat rather than an actual cost of being in deficit.
0xean marked the issue as duplicate
0xean marked the issue as selected for report
Simon-Busch marked the issue as not a duplicate
Simon-Busch marked the issue as primary issue
08xmt marked the issue as sponsor disputed
Working as intended.
Lines of code
https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L559-L572 https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L531-L539 https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L472-L474 https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L460-L466
Vulnerability details
Impact
When a user incurs a DBR deficit, a replenisher can call the
forceReplenish
function to force the user to replenish DBR. However, there is no guarantee that theforceReplenish
function will always be called. When theforceReplenish
function is not called, such as because that the replenisher does not notice the user's DBR deficit promptly, the user can just call therepay
function to repay the origianl debt and thewithdraw
function to receive all of the deposited collateral even when the user has a DBR deficit already. Yet, in the same situation, if theforceReplenish
function has been called, more debt should be added for the user, and the user needs to repay more in order to get back all of the deposited collateral. Hence, when theforceReplenish
function is not called while it could be called, theMarket
contract would receive less DOLA if the user decides to repay the debt and withdraw the collateral both in full.https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L559-L572
https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L531-L539
https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L472-L474
https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L460-L466
Proof of Concept
Please add the following test in
src\test\Market.t.sol
. This test will pass to demonstrate the described scenario.Tools Used
VSCode
Recommended Mitigation Steps
When calling the
repay
function, the user's DBR deficit can also be checked. If the user has a DBR deficit, an amount, which is similar toreplenishmentCost
that is calculated in theforceReplenish
function, can be calculated; it can then be used to adjust therepay
function'samount
input for updating the states regarding the user's and total debts in the relevant contracts.