Closed c4-bot-8 closed 5 months ago
This submission should have spent more time explaining what's going on
GalloDaSballo marked the issue as insufficient quality report
High without coded / worded POC = insufficient proof.
trust1995 marked the issue as unsatisfactory: Insufficient proof
Lines of code
https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/WrapperHub/AaveHub.sol#L393-L427 https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/WrapperHub/AaveHelper.sol#L141-L163
Vulnerability details
Impact
When borrowing ETH, the profit generated from Aave is not lent to the user, so the profit is locked in the contract.
Proof of Concept
AaveHub.sol#borrowExactAmountETH
function is as follows.Because
_wrapBorrowExactAmount
is called inL405
,borrowshares
becomes larger than_borrowAmount
. However, inL412-L416
, only_borrowAmount
is given to the user, so the difference betweenborrowShares
and_borrowAmount
remains as an expectation. Meanwhile,AaveHelper.sol#_wrapBorrowExactAmount
function is as follows.Here,
_underlyingAssetRecipient
isaddress(this)
as seen inL408
, so the profit generated from Aave is locked in the contract.Tools Used
Manual Review
Recommended Mitigation Steps
The profits generated from Aave must be transferred to the user.
Assessed type
Token-Transfer