currentOwner != newOwner check is needed in transferLPs and approveLpOwnership

Summary

approveLpOwnership and transferLPs are used to transfer position to other address. Here currentOwner != newOwner check is needed.

Vulnerability Detail

Let's assume that some funny user approve LP ownership to himself again, and called transferLPs. As it delete the old owner's position completely, all assets of him are locked.

Impact

Whole position of user can be locked

Code Snippet

https://github.com/sherlock-audit/2023-01-ajna/blob/main/contracts/src/libraries/external/LenderActions.sol#L500-L558

// move lp tokens to the new owner address
Lender storage newLender = bucket.lenders[newOwner_];

newLender.lps += transferAmount;

newLender.depositTime = Maths.max(lenderDepositTime, newLender.depositTime);

// reset owner lp balance for this index
delete bucket.lenders[owner_];

Tool used

Manual Review

Recommendation

if (owner != newOwner) revert SameOwnerTransferLPs(); like it did in moveQuoteTokens()

sherlock-audit / 2023-01-ajna-judging

james_wu - currentOwner != newOwner check is needed in transferLPs and approveLpOwnership #154