Closed c4-bot-1 closed 5 months ago
GalloDaSballo marked the issue as insufficient quality report
Missing impact in context
GalloDaSballo marked the issue as primary issue
trust1995 marked the issue as unsatisfactory: Insufficient proof
Insufficient proof of impact is valid for scrapping.
Lines of code
https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PowerFarms/PendlePowerFarm/PendlePowerFarm.sol#L157-L179 https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/InterfaceHub/IWiseLending.sol#L306-L312 https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/WiseLending.sol#L67-L90
Vulnerability details
Description:
Function Interface
IWiseLending::withdrawExactShares
does not apply essential modifiers and checks forsyncPool()
andhealthStateCheck()
. hence, functions inheriting the interface likePendlePowerFarm::_manuallyWithdrawShares
are not checked to know if positions are healthy or not and might lead to wrong values in ascertaining positions that should be liquidated.Impact:
Break in core contract logic in asscertaining the health factor of positions
Tools Used
Manual Review
Proof Of Concept:
Recommended Mitigation Steps:
Create an interface in the
IWiseLending
with an external function forAdd additional checks to check for the health State of positions in
PendlePowerFarm::_manuallyWithdrawShares
using the_healthStateCheck()
Assessed type
Context