search

sherlock-audit / 2023-02-blueberry-judging

12 stars 5 forks source link

Ch_301 - User could bypass the `MaxLTV` #340

Closed github-actions[bot] closed 1 year ago

github-actions[bot] commented 1 year ago

Ch_301

high

User could bypass the MaxLTV

Summary

Users can use this method with the different functions we just use reducePosition() to explain it

Vulnerability Detail

Alice open a position with strategyId == ID01 and collToken == TokenA The MaxLTV of TokenA in the strategy ID01 is 2.5X.

These are the critical values of Alice's position getPositionValue Is: 20k USD getDebtValue Is: 20k USD getUnderlyingValue Is: 10k USD

Now, Alice invokes reducePosition() with strategyId == ID02 The MaxLTV of TokenA in the strategy ID02 is 3X.

So, the _validateMaxLTV() will do the check calculation with a different maxLTV

and this will lead to a wrong check

Impact

the user will reduce his position more than it should

Code Snippet

Tool used

Manual Review

Recommendation

You need to check strategy.vault with pod.collId

Duplicate of #129