Open c4-bot-4 opened 4 months ago
MarioPoneder marked the issue as primary issue
Technically true, but not really a problem for us / by design. Removing from the whitelist (i.e. blacklisting) is a permissioned operation that should only be performed under exceptional circumstances (e.g. when the corresponding market is exploited). I am not sure if the suggestion would be better in such scenarios because an attacker (that may have already performed some sync calls) could then still claim
OpenCoreCH (sponsor) acknowledged
Blacklisting is intended by design, governance controlled and reversible. Therefore rewards are not irrecoverably locked.
MarioPoneder changed the severity to QA (Quality Assurance)
MarioPoneder marked the issue as grade-a
Lines of code
https://github.com/code-423n4/2024-03-neobase/blob/main/src/LendingLedger.sol#L122
Vulnerability details
Impact
If a market is removed from the whitelist before a user claims the reward, users cannot claim it, and the reward will remain stuck.
Proof of Concept
When users want to claim the reward from
LendingLedger
by callingclaim
, it will triggerupdate_market
first before contract sending the reward to users.https://github.com/code-423n4/2024-03-neobase/blob/main/src/LendingLedger.sol#L122
Inside
update_market
, if the market is not whitelisted, the call will revert.https://github.com/code-423n4/2024-03-neobase/blob/main/src/LendingLedger.sol#L65
This could lead to an issue, if the market is removed from the whitelist before users can claim the reward, they cannot claim it, and the reward will remain stuck inside
LendingLedger
.Tools Used
Manual review
Recommended Mitigation Steps
Consider to allow users provide additional flag param when calling
claim
so they can claim reward without triggeringupdate_market
.Assessed type
Invalid Validation