sherlock-audit / 2022-10-union-finance-judging

4 stars 1 forks source link

ak1 - UToken.sol#L518 : It is safe to consider to check for if(fee > 0) #148

Closed sherlock-admin closed 2 years ago

sherlock-admin commented 2 years ago

ak1

medium

UToken.sol#L518 : It is safe to consider to check for if(fee > 0)

Summary

UToken.sol#L518 : During borrow of Utoken, fee is computed to proceed the borrow. But it is not validated whether the calculated fee value is greater than zero or not.

Vulnerability Detail

There are chances that the calculated fee amount could be equal to zero. This can be seen by checking how the fee is calculated.

https://github.com/sherlock-audit/2022-10-union-finance/blob/main/union-v2-contracts/contracts/market/UToken.sol#L389-L391

when the product of (originationFee * amount) is lesser than WAD, then the calculated fee will be zero.

Impact

For some amount, user can borrow without paying fee. this could be loss to the protocol.

Code Snippet

https://github.com/sherlock-audit/2022-10-union-finance/blob/main/union-v2-contracts/contracts/market/UToken.sol#L517-L521

Tool used

Manual Review

Recommendation

Add validation check for fee if(fee > 0) to proceed further for borrow.