Full repayment for Singularity and BigBang can be grief-attacked by frontrunning it with 1 wei repayment

[code423n4]

Lines of code

https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/markets/singularity/SGLLendingCommon.sol#L91 https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/markets/bigBang/BigBang.sol#L728 https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/usd0/BaseUSDO.sol#L313

Vulnerability details

The _repay() in Singularity will deduct user's borrowed amount userBorrowPart[to] by the repayment amount part as shown in the code below.

However, an attacker could cause this to revert and grief a full repayment by frontrunning it with a 1 wei repayment on the victim's behalf. This attack is possible as Singularity allows repayment on behalf.

One might argue that frontrunning is not possible on the host chain (Arbitrum), but that is not true for an omnichain protocol as it extends beyond the host chain. That means the attacker could monitor for the cross chain repayments initiated from another chain that has a mempool (e.g. USDO.sendAndLendOrRepay() tx on Ethereum), and then frontrun it with the grief attack before it is sent over to the Singularity market on Arbitrum.

https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/markets/singularity/SGLLendingCommon.sol#L91

    function _repay(
        address from,
        address to,
        bool skim,
        uint256 part
    ) internal returns (uint256 amount) {
        (totalBorrow, amount) = totalBorrow.sub(part, true);

        userBorrowPart[to] -= part;

        uint256 share = yieldBox.toShare(assetId, amount, true);
        uint128 totalShare = totalAsset.elastic;
        _addTokens(from, to, assetId, share, uint256(totalShare), skim);
        totalAsset.elastic = totalShare + uint128(share);
        emit LogRepay(skim ? address(yieldBox) : from, to, amount, part);
    }

Impact

The attack can be used to DoS any users' full repayment. A malicious liquidator could perform this attack to prevent any full repayment of undercollateralized positions, subjecting the users to liquidation.

Recommended Mitigation Steps

Support the ability to overpay for the repayment and refund any excess payment.

Assessed type

DoS

[c4-pre-sort]

minhquanym marked the issue as duplicate of #64

[c4-judge]

dmvt marked the issue as satisfactory