A successful challenge can be ended via MintingHub.end().
This transfers challenge.size collateral back to the challenger, before repaying the challenge and paying the challenger the reward.
In this call, position.notifyChallengeSucceeded is called.
This transfers the position's collateral to the highest bidder.
File: Position.sol
351: notifyRepaidInternal(repayment); // we assume the caller takes care of the actual repayment
352: internalWithdrawCollateral(_bidder, _size); // transfer collateral to the bidder and emit update
The issue is that in case of a token with blacklist (USDC, USDT), if the bidder is blacklisted before the end() call, the transfer line 269 will revert
Impact
end() will always revert for this challenge.
The challenge cannot be ended and the challenger will never retrieve their size collateral.
Tools Used
Manual Analysis
Mitigation
end() already handles the case where the challenger is blacklisted by such tokens.
Add a similar functionality in notifyChallengeSucceeded() for the internalWithdrawCollateral() internal call.
Lines of code
https://github.com/code-423n4/2023-04-frankencoin/blob/1022cb106919fba963a89205d3b90bf62543f68f/contracts/Position.sol#L352 https://github.com/code-423n4/2023-04-frankencoin/blob/1022cb106919fba963a89205d3b90bf62543f68f/contracts/Position.sol#L269
Vulnerability details
A successful challenge can be ended via
MintingHub.end()
. This transferschallenge.size
collateral back to thechallenger
, before repaying the challenge and paying the challenger the reward.In this call,
position.notifyChallengeSucceeded
is called. This transfers the position's collateral to the highest bidder.The issue is that in case of a token with blacklist (
USDC
,USDT
), if the bidder is blacklisted before theend()
call, the transfer line 269 will revertImpact
end()
will always revert for this challenge. The challenge cannot be ended and the challenger will never retrieve theirsize
collateral.Tools Used
Manual Analysis
Mitigation
end()
already handles the case where the challenger is blacklisted by such tokens. Add a similar functionality innotifyChallengeSucceeded()
for theinternalWithdrawCollateral()
internal call.