Closed c4-bot-10 closed 5 months ago
Seems incorrect, since the value is bound
_shares = bound(
_shares,
0,
lendingUserInstance.getPositionBorrowShares(_nftId, tokens[_tokenIndex])
);
GalloDaSballo marked the issue as insufficient quality report
GalloDaSballo marked the issue as primary issue
Should be marked as invalid.
trust1995 marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/WiseLending.sol#L1161-L1198 https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/WiseLending.sol#L1204-L1238
Vulnerability details
Impact
Borrowers could lose the excess amount of ERC20 to be paid back, as it would be stuck inside the WiseLending contract and never refunded to the borrower.
Proof of Concept
This issue involves two scenarios where the
paybackExactAmount()
andpaybackExactShares()
functions are called with parameters that could lead to incorrect repayment calculations. The contract should include checks to ensure that the repayment amount and the corresponding shares do not exceed the borrower's current borrow shares.Scenario 1: paybackExactAmount() Function https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/WiseLending.sol#L1161-L1198
Bob has a position in the WiseLending contract with an NFT ID of
12345
. He has borrowed a token with the address0xBorrowedToken
and has a maximum of200
borrow shares (maxBorrowShares
) for this token. Bob calls thepaybackExactAmount()
function with an_amount
of1000
, which results in500
shares to repay. However, the contract does not include a check to ensure thatpaybackShares
does not exceedmaxBorrowShares
, leading to an incorrect update of the contract's state and the loss of800
units of the borrowed token.Scenario 2: paybackExactShares() Function https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/WiseLending.sol#L1204-L1238
Alice has a position in the WiseLending contract with an NFT ID of
67890
. She has borrowed a token with the address0xBorrowedToken
and has a maximum of300
borrow shares (maxBorrowShares
) for this token. Alice calls thepaybackExactShares()
function with_shares
of400
, which results in2000
units of the borrowed token to repay. However, the contract does not include a check to ensure thatrepaymentAmount
does not exceedmaxBorrowShares
, leading to an incorrect update of the contract's state and the loss of1700
units of the borrowed token.Detailed difference between both scenarios:
Both issues involve incorrect repayment calculations that could lead to a loss of funds for borrowers. The first issue is related to the amount of the borrowed token being repaid, while the second issue is related to the number of shares being repaid. In both cases, the contract should include checks to ensure that the repayment amount and the corresponding shares do not exceed the borrower's current borrow shares.
Tools Used
Manual Review
Recommended Mitigation Steps
Include a check in the
_handlePayback()
function to ensure that thepaybackShares
do not exceed themaxBorrowShares
when thepaybackExactAmount()
function is called. Also Include a check in the_handlePayback()
function to ensure that therepaymentAmount
does not exceed themaxBorrowShares
when thepaybackExactShares()
function is called.Assessed type
ERC20