Closed c4-bot-3 closed 5 months ago
A POC would have been massively beneficial here
GalloDaSballo marked the issue as primary issue
GalloDaSballo marked the issue as sufficient quality report
if there is no POC provided is it still sufficient quality report?
seems like also a duplicate for: https://github.com/code-423n4/2024-02-wise-lending-findings/issues/243
so same comments from https://github.com/code-423n4/2024-02-wise-lending-findings/issues/243 would be relevant here
trust1995 marked the issue as duplicate of #243
trust1995 marked the issue as satisfactory
trust1995 marked the issue as duplicate of #74
Lines of code
https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/WiseSecurity/WiseSecurity.sol#L427-L429 https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/FeeManager/FeeManager.sol#L663-L675 https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/FeeManager/FeeManager.sol#L689-L699
Vulnerability details
Impact
All the fees collected from the FEE_MANAGER_NFT will be unclaimable on the FeeManager contract because the totalBadDebtETH will never be able to go back to 0.
Proof of Concept
Liquidations in the WiseLending market are designed to allow the liquidators to liquidate debt from a specific pool and receive the liquidation payment on a different pool (if they want it, they can also receive the liquidation payment in the same type of poolToken if the position has collateralized deposits on such a pool).
When a liquidation is done, after all the lending and borrowing storage variables have been updated according to the amount of debt repaid by the liquidator, the liquidation logic checks if there is any bad debt in the position by calling the
WISE_SECURITY.checkBadDebtLiquidation() function
, any bad debt (the difference between theoverallETHBorrowBare - overallETHCollateralsBare
) is reported to the FeeManager, to do this, two functions are called, theFEE_MANAGER.increaseTotalBadDebtLiquidation() function
and theFEE_MANAGER.setBadDebtUserLiquidation() function
.}
function increaseTotalBadDebtLiquidation( uint256 _amount ) external onlyWiseSecurity { _increaseTotalBadDebt( _amount );
}
function _increaseTotalBadDebt( uint256 _amount ) internal { //@audit-info =>
totalBadDebtETH
is increased by the baddebt computed in the current liquidation totalBadDebtETH += _amount; ... }function setBadDebtUserLiquidation( uint256 _nftId, uint256 _amount ) external onlyWiseSecurity { _setBadDebtPosition( _nftId, _amount ); ... }
function _setBadDebtPosition( uint256 _nftId, uint256 _amount ) internal { //@audit-info =>
badDebtPosition
is overridden by the baddebt computed in the current liquidation badDebtPosition[_nftId] = _amount; }//@audit-info =>
_newBadDebt
would be the current bad debt on the position that is been liquidated on the WiseLending contract! function registerBadDebt(_nftId, _newBadDebt) external onlyWiseSecurity {}
function checkBadDebtLiquidation( uint256 _nftId ) external onlyWiseLending {
FEE_MANAGER.registerBadDebt(_nftId,diff);
FEE_MANAGER.increaseTotalBadDebtLiquidation(
diff
);
FEE_MANAGER.setBadDebtUserLiquidation(
_nftId,
diff
); } }
FEE_MANAGER.increaseTotalBadDebtLiquidation() function
&& theFEE_MANAGER.setBadDebtUserLiquidation() function
can now be deleted from the FeeManager contract. They will not be used anymore. The new function will be in charge of tracking and updating the total bad debt as well as the individual user's bad debt.Assessed type
Context