Closed c4-bot-9 closed 5 months ago
I believe this should be QA
The constant is 56 days which is 8 weeks
GalloDaSballo marked the issue as insufficient quality report
GalloDaSballo marked the issue as duplicate of #141
trust1995 changed the severity to QA (Quality Assurance)
Lines of code
https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/WiseLendingDeclaration.sol#L304-L307 https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PoolManager.sol#L301 https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PoolManager.sol#L201-L204 https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PoolManager.sol#L224 https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PoolManager.sol#L73-L76 https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PoolManager.sol#L90 https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/MainHelper.sol#L1103-L1104 https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/MainHelper.sol#L1132-L1133
Vulnerability details
Impact
The
NORMALISATION_FACTOR
constant was set with the wrong number. This constant is used to calculate thedeltaPole
variable, which will be used to calculate an increasing and decreasing step of the LASA algorithm'sresonanceFactor
variable.Therefore, the wrong
NORMALISATION_FACTOR
constant leads to the malfunctioning of the LASA algorithm.Proof of Concept
The
NORMALISATION_FACTOR
constant was set to4838400
. This constant represents an amount of seconds for two months that should be5259492
(ref: https://www.calculateme.com/time/months/to-seconds/2) instead.@1 -- Wrong constant (two months in seconds must be 5_259_492)
: https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/WiseLendingDeclaration.sol#L304-L307The wrong
NORMALISATION_FACTOR
constant is used to calculate thedeltaPole
variable in thePoolManager::_getDeltaPole()
.This incorrectly calculated
deltaPole
will then be utilized byPoolManager::_createPool()
andPoolManager::setParamsLASA()
in order to configure it into theborrowRatesData[_params.poolToken]
mapping.@2 -- The wrong constant is used to calculate the deltaPole
: https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PoolManager.sol#L301@3.1 -- The incorrectly calculated deltaPole is utilized by the _createPool()
: https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PoolManager.sol#L201-L204@3.2 -- The incorrectly calculated deltaPole is configured into the BorrowRatesEntry struct
: https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PoolManager.sol#L224@4.1 -- The incorrectly calculated deltaPole is utilized by the setParamsLASA()
: https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PoolManager.sol#L73-L76@4.2 -- The incorrectly calculated deltaPole is configured into the BorrowRatesEntry struct
: https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PoolManager.sol#L90Later, the incorrectly calculated
deltaPole
will be used to calculate an increasing step of the LASA algorithm'sresonanceFactor
variable in theMainHelper::_increaseResonanceFactor()
.Also, the incorrect
deltaPole
will be used to calculate a decreasing step of the LASA algorithm'sresonanceFactor
variable in theMainHelper::_decreaseResonanceFactor()
.For this reason, the wrong
NORMALISATION_FACTOR
constant leads to the malfunctioning of the LASA algorithm.@5.1 -- The incorrectly calculated deltaPole is used to calculate an increasing step of the LASA algorithm's resonanceFactor
: https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/MainHelper.sol#L1103-L1104@5.2 -- The incorrectly calculated deltaPole is used to calculate a decreasing step of the LASA algorithm's resonanceFactor
: https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/MainHelper.sol#L1132-L1133Tools Used
Manual Review
Recommended Mitigation Steps
Correct the value of the
NORMALISATION_FACTOR
constant.The correct amount of seconds for two months should be
5259492
(ref: https://www.calculateme.com/time/months/to-seconds/2).Assessed type
Other