Open hats-bug-reporter[bot] opened 6 months ago
Hey,
I am not sure why you think that the curve security check is related to _prepareAssociatedTokens()
. This function only adds the acquired tokens from the borrow rate since last interaction to have the latest pseudo amounts for follow up compuation of all token the user has at this point. Afterwards the borrow process begins and in the end of the function, after the borrow token is added to the token list of the user, we perfrome the _curveSecurityChecks()
. Just look at line 397 in WiseCore.sol.
As you can see in the above picture, _addPositionTokenData()
is performed before _curveSecurityChecks()
and therefore the above attack is not possible. Do you agree with that?
Because the lendTokens
and borrowTokens
which are passed as arguments to _curveSecurityChecks()
are the arrays returned by _prepareAssociatedTokens()
. So _curveSecurityChecks()
performs the check on lendTokens
and borrowTokens
and not the updated token list of the user.
allowborrow: false -> doesnt matter curve pools not intended to be used for borrowing, only as collateral.
@vonMangoldt can confirm.
Thanks you for your reponse.
As the reentrancy check is performed on borrowTokens
as well one would assume that curve lp tokens could be borrowed.
Thank you for your effort. You are right with the above statement, that the performed borrowTokens check is redundant and can be removed. Despite that this is oos, we take this change in our code and will discuss internally how/if we can reward you with a litte amount for that finding.
Github username: @bahurum Twitter username: bahurum Submission hash (on-chain): 0x445cf137ddf578bc3c58b45f02850886f981c27fc76282da35a904c6b95d4c82 Severity: high
Description: Description\ The function
MainHelper._curveSecurityChecks()
will check for curve lp tokens price manipulation via read-only-reentrancy for all_lendTokens
and_borrowTokens
used by thenftId
.The issue is that in
WiseCore._coreBorrowTokens()
the function_prepareAssociatedTokens()
is called before_addPositionTokenData()
, meaning that_poolToken
isn't included in theborrowTokens
array and the curve reentrancy check is not performed on it.With read-only-reentrancy, the curve pool's
virtual_price
can be manipulated downwards, so the health check will allow to borrow more of the lp token than it should be allowed, at the profit of an attacker.Attack Scenario\ Consider this simplified scenario:
Impact\ Borrowable curve lp tokens with manipulatable virtual price can be drained from the protocol at a profit, leaving bad debt in the protocol.
Recommendation\ In
_coreBorrowTokens()
, add_poolToken
to theborrowTokens
array before passing it into_curveSecurityChecks()
.Attachments