search

salvorio / salvor-contracts

0 stars 0 forks source link

[SLG-06M] Incorrect Configuration of Dutch Auction #23

Open HKskn opened 3 months ago

HKskn commented 3 months ago

SLG-06M: Incorrect Configuration of Dutch Auction

Type Severity Location
Logical Fault SalvorLending.sol:L478, L518

Description:

The SalvorLending::setDutchAuction function invocations referenced will utilize a fixed "start price" of three times the loan offer amount, however, that value is not necessarily greater than the endPrice as the rate of a lending pool is uncapped.

Impact:

The Dutch auction of the loan will be inoperable if its starting price is greater than its end price due to an underflow occurring within SalvorLending::getDutchPrice.

Example:

uint256 endPrice = _loanOffer.amount + ((_loanOffer.amount * lendingPool.rate) / 1 ether);

setDutchAuction(_loanOffer.nftContractAddress, token.tokenId, _loanOffer.amount*3, endPrice, block.timestamp + lendingPool.duration);

Recommendation:

We advise the code to instead configure the start price as three times the endPrice, ensuring that the gradient via which the price reduces is properly scaled based on the loan's evaluation.

HKskn commented 3 months ago

Fixed