Closed c4-submissions closed 9 months ago
bytes032 marked the issue as sufficient quality report
bytes032 marked the issue as duplicate of #308
jhsagd76 changed the severity to 2 (Med Risk)
jhsagd76 marked the issue as satisfactory
jhsagd76 changed the severity to QA (Quality Assurance)
Lines of code
https://github.com/code-423n4/2023-10-badger/blob/f2f2e2cf9965a1020661d179af46cb49e993cb7e/packages/contracts/contracts/CdpManager.sol#L621
Vulnerability details
Description
Users can manipulate the redemption fee using a flash loan in the following way: A user wants to redeem X eBTC. They use a flash loan to borrow as much collateral from the system as possible leaving only the amount needed for their redemption. Using the loan they open a CDP and borrow eBTC against it, thus arficially increasing the system debt and by that reducing the baseRate calculated here. The user can then redeem X eBTC for a reduced fee, close the opened CDP and repay the flashloan plus fee. The POC proves this can be done with a significant overall cost reduction (accounting for the flash fee) for the user.
Impact
A malicious party can deploy a contract that allows anyone to redeem eBTC rigging the fee system using this method. This will have a sifnificant affect on protocol fees as well as break the intended system economics, potentially leading for the entire protocol to be taken down and relaunched with a fix.
Proof of Concept
The following test can be added and run under the foundry_test folder. Run each test once:
forge test --match-test testRedemptionFeeManipulation -vv
thenforge test --match-test testRedemptionFeeNoManipulation -vv
to compare the fees paid with and without the manipulation. Note that for the test data the actor can reduce their cost by more than 40%Tools Used
Foundry
Recommended Mitigation Steps
This finding is caused by the fact that during the flash loan a discrepancy exists between the internal accounting of the system and the real collateral ballance of the pool (enabling the same collateral to be counted twice and consequently used to bloat up the system debt). A safe approach would be to block borrowerOperations all together during the flashloan and allow the loan to be used only externally.
Assessed type
Other