search

code-423n4 / 2023-10-wildcat-findings

14 stars 10 forks source link

Protocol fees can be bypassed through penalty rates #597

Open c4-submissions opened 1 year ago

c4-submissions commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/libraries/FeeMath.sol#L45

Vulnerability details

Impact

As mentioned in the previous audit by aleph_v, protocol fees can be bypassed while still paying the same rate to the lenders. The issue was neither resolved nor acknowledged.

Proof of Concept

The overall interest paid by the borrower is the interest times the protocol fee plus any delinquency fees. By setting the delinquency fee percent to the intended interest and then setting the protocol interest percent to zero (or close to zero) the borrower can construct a vault which pays the lenders the same amount of interest via delinquency fees as it would pay via interest. The borrower can increase the liquidity requirements to force payment of persistent delinquency fees. In this case the lenders have no incentive to withdraw as they get the same rate and borrowers pay a net lower fee as no protocol fee is collected. aleph_v, FeeMath.sol#L45

Tools Used

Manual Review

Recommended Mitigation Steps

Charge protocol fees on the extra interest which is paid by delinquent loans.

Assessed type

Other

c4-pre-sort commented 1 year ago

minhquanym marked the issue as sufficient quality report

laurenceday commented 1 year ago

Not a finding, and also quoting something specifically out of scope from a previous review.

c4-sponsor commented 1 year ago

laurenceday (sponsor) disputed

c4-judge commented 1 year ago

MarioPoneder changed the severity to QA (Quality Assurance)

MarioPoneder commented 1 year ago

QA:

  1. Don't see incentive for lender to lose the feature of "real" delinquency. However, it is till possible.
  2. Although, a previous audit report was listed in the README, I cannot see where it was specifically declared out of scope.
c4-judge commented 1 year ago

MarioPoneder marked the issue as grade-b