Closed c4-bot-1 closed 8 months ago
0xSorryNotSorry marked the issue as sufficient quality report
0xSorryNotSorry marked the issue as duplicate of #877
Trumpero marked the issue as unsatisfactory: Invalid
Trumpero marked the issue as unsatisfactory: Invalid
Trumpero marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/SurplusGuildMinter.sol#L113-L212
Vulnerability details
Summary
The amount of interest that lenders earn is based on the amount of credit tokens staked on the given term. This mechanism is vulnerable to sandwich attacks. MEV bots can sandwich any profit in the terms by staking right before the interest is earned and unstaking right after. This way, the MEV bot can potentially take the biggest part of the interest from the honest lenders, without providing any value to the protocol and not risking any capital (except from MEV gas cost risks).
Vulnerability Details
The
SurplusGuildMinter
contract is used to stake and unstake credit tokens on terms, which updates theirtermSurplusBuffer
and therefore provides liquidity to borrow. The amount of interest that lenders earn is based on the amount of credit tokens staked on the given term. But this mechanism is vulnerable to sandwich attacks, as there is no technique to prevent it, and it is possible to stake and unstake in the same block.Here we can see the stake and unstake function and therefore that there is no technique to prevent sandwich attacks implemented:
The following POC can be implemented in the
SurplusGuildMinter.t.sol
test file:Impact
MEV bots can sandwich any profit in the terms by staking and unstaking and potentially take the biggest part of the interest from the honest lenders.
Recommendations
Implement a lockup period between staking and unstaking so that every staker risks funds and provides value to the system and only earns interest by doing so. Implementing Withdraw fees would also be a good idea to decrease the incentive for MEV bots.
Assessed type
MEV