ctf_sec - principal value for element, pendle, APWine, Tempus, and Sense lending function is not validated.

[sherlock-admin]

ctf_sec

medium

principal value for element, pendle, APWine, Tempus, and Sense lending function is not validated.

Summary

principal value for element, pendle, APWine, Tempus, and Sense lending function is not validated.

Vulnerability Detail

Note in the lending function for illuminate and yield protocol validates the principal value.

// Check that the principal is Illuminate or Yield
  if (
      p != uint8(MarketPlace.Principals.Illuminate) &&
      p != uint8(MarketPlace.Principals.Yield)
  ) {
      revert Exception(6, 0, 0, address(0), address(0));
  }

same validation is implemented in Swivel.

// Check that the principal is Swivel
    if (p != uint8(MarketPlace.Principals.Swivel)) {
        revert Exception(
            6,
            p,
            uint8(MarketPlace.Principals.Swivel),
            address(0),
            address(0)
        );
 }

However, such validation is missing for lending function in element, pendle, APWine, Tempus, and Sense

Impact

Without such validation, the user can use a different principle token with different maturity to lend in wrong protocol.

Code Snippet

https://github.com/sherlock-audit/2022-10-illuminate/blob/main/src/Lender.sol#L306-L313

https://github.com/sherlock-audit/2022-10-illuminate/blob/main/src/Lender.sol#L372-L382

Tool used

Manual Review

Recommendation

We recommend the lending function for element, pendle, APWine, Tempus, and Sense validate the principle value. For example:

    if (p != uint8(MarketPlace.Principals.Element)) {
        revert Exception(
            6,
            p,
            uint8(MarketPlace.Principals.Element),
            address(0),
            address(0)
        );
 }