james_wu - transferLps(): we should assume allowance can be greater than actual transfer amount

[github-actions[bot]]

james_wu

medium

transferLps(): we should assume allowance can be greater than actual transfer amount

Summary

approveLpOwnership and transferLPs are used to transfer position to other address. but in transferLPs(), it reverts when allowance is not exactly same as LP balance

Vulnerability Detail

Impact

Users normally set allowance as infinite. Inconviniency in such basic function could result less protocol users in numbers

Code Snippet

https://github.com/sherlock-audit/2023-01-ajna/blob/main/contracts/src/libraries/external/LenderActions.sol#L500-L558

uint256 transferAmount = allowances_[owner_][newOwner_][index];

Bucket storage bucket = buckets_[index];
Lender storage lender = bucket.lenders[owner_];

uint256 lenderDepositTime = lender.depositTime;

uint256 lenderLpBalance;

if (bucket.bankruptcyTime < lenderDepositTime) lenderLpBalance = lender.lps;

if (transferAmount == 0 || transferAmount != lenderLpBalance) revert NoAllowance();

Tool used

Manual Review

Recommendation

• if (transferAmount == 0 || transferAmount != lenderLpBalance) revert NoAllowance();
• if (transferAmount < lenderLpBalance) revert NoAllowance();