code423n4 commented 11 months ago

Lines of code

https://github.com/code-423n4/2023-07-moonwell/blob/fced18035107a345c31c9a9497d0da09105df4df/src/core/Comptroller.sol#L844 https://github.com/code-423n4/2023-07-moonwell/blob/fced18035107a345c31c9a9497d0da09105df4df/src/core/Comptroller.sol#L807

Vulnerability details

Impact

An admin or cap guardian are able to set their caps to any arbitrary value without any timelock or restrictions. This can be abused by a malicious admin or guardian to prevent certain users from joining (or borrowing from) particular markets using frontrunning.

I believe medium severity is suitable as it can prevent users from being able to use the protocol but assumes we have a malicious guardian or admin

Proof of Concept

Alice is set as the new supply guardian for Comptroller.sol through _setSupplyCapGuardian()
Bob tries to start lending in the DAI market place by calling mDAI.mint()
However, Alice frontruns Bob and sets supplyCap to 1
mDai.mint() will call comptroller.mintAllowed() to ensure that all checks pass. However, as supplyCap != 0, unless there is no available funding in mDAI, then the mintAmount + cash + borrows - reserves < totalSupplyCap will fail thereby preventing Bob from joining the market
Alice can then reset the supply cap to its original value

Tools Used

VSCode

Recommended Mitigation Steps

Consider adding a timelock to the supply caps with a queue and execute system or adding a minimum value (i.e. the current supply of the market) so that certain users cannot be hazed.

_queueMarketSupplyCaps(MToken[] calldata mTokens, uint[] calldata newSupplyCaps) external {
    ... // Sanity and admin checks
    queueTime = block.timestamp;
    pendingMToken = mTokens;
    pendingSupplyCaps= new SupplyCaps;
}

_executeMarketSupplyCaps() external {
    ... // Sanity and admin checks
    require(queueTime > 0, "No caps have been queued");
    require(queueTime + 2 hours <= block.timestamp, "Cannot change supply caps");
    for (uint i = 0; i < pendingMTokens.length; i++) {
        supplyCaps[address(pendingMTokens[i])] = pendingSupplyCaps[i];
    }
    queueTime = 0;

}