The BorrowerOperations.sol contract flashloan function does not check for an overflow when adding the fees to the flashloan amount. This could lead to an issue where the attacker does not need to pay back the flashloan as they will burn 0 tokens.
Proof of Concept
Arithmetic overflow occurs when the result of a mathematical operation exceeds the maximum value that can be stored in a variable. For example, consider a uint256 variable that can store values between 0 and 2²⁵⁶ — 1. If we add 1 to the maximum value that can be stored in a uint256, the result will be 0, which is called an overflow.
Lines of code
https://github.com/code-423n4/2023-10-badger/blob/f2f2e2cf9965a1020661d179af46cb49e993cb7e/packages/contracts/contracts/BorrowerOperations.sol#L1100-L1108
Vulnerability details
Impact
The BorrowerOperations.sol contract flashloan function does not check for an overflow when adding the fees to the flashloan amount. This could lead to an issue where the attacker does not need to pay back the flashloan as they will burn 0 tokens.
Proof of Concept
Arithmetic overflow occurs when the result of a mathematical operation exceeds the maximum value that can be stored in a variable. For example, consider a uint256 variable that can store values between 0 and 2²⁵⁶ — 1. If we add 1 to the maximum value that can be stored in a uint256, the result will be 0, which is called an overflow.
Tools Used
Manual Review
Recommended Mitigation Steps
Use safeMath library
Assessed type
Under/Overflow