search

hats-finance / Tapioca--Lending-Engine--0x5bee198f5b060eecd86b299fdbea6b0c07c728dd

Other
0 stars 0 forks source link

`BBLeverage.sellCollateral` will not work if `from` doesn't have debt #26

Open hats-bug-reporter[bot] opened 5 months ago

hats-bug-reporter[bot] commented 5 months ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0xd8fa4e80bac5d13f82a932eb9dc2dee46246e26aab1bd5b5d45eab84199ec2d8 Severity: medium

Description: Description\ I'm not sure if this is intended or not. But for my understanding, BBLeverage.sellCollateral should be able to be used to exchange collateral for USDO even if from doesn't have debt.

If from doesn't have debt, the code flow will fall into the if branch, and in BBLendingCommon._repay, the function will revert if part == 0

Which means that if the from doesn't have any debt, the tx will revert.

Same issue also exists in SGLLeverage.sellCollateral

Attack Scenario\ So if a user just wants for exhange some collateral token for USDO, he/she has to borrow some USDO first

cryptotechmaker commented 5 months ago

It defeats the purpose of the method. Sell collateral is used to pay debt