Original vulnerabilities:
settleWtihBuyout() transfers the originator fee directly from the liquidator contract balalance. The problem is during the buyout flow, no bids have been placed so there’s no fee in the contract to pay for the originator fee.
Original impacts:
This will either revert the buyout tx, or when other auctions are going in parallel this steals fees from proceeds of other loan auctions.
The originator fee is now transferred from buyer/msg.sender, which is the lender initiating the buyout tx. This eliminates the attack vector and resolves the issue.
Lines of code
Vulnerability details
C4 Issue
H-05: triggerFee is stolen from other auctions during settleWithBuyout()
Comments
Original vulnerabilities:
settleWtihBuyout()
transfers the originator fee directly from the liquidator contract balalance. The problem is during the buyout flow, no bids have been placed so there’s no fee in the contract to pay for the originator fee.Original impacts: This will either revert the buyout tx, or when other auctions are going in parallel this steals fees from proceeds of other loan auctions.
Mitigation:
Fix: https://github.com/pixeldaogg/florida-contracts/pull/370/files
The originator fee is now transferred from buyer/msg.sender, which is the lender initiating the buyout tx. This eliminates the attack vector and resolves the issue.
Test
The revised test is passing.
Conclusion
LGTM