sherlock-audit / 2023-03-notional-judging

12 stars 6 forks source link

bin2chen - getAccountPrimeDebtBalance() always return 0 #173

Open sherlock-admin opened 1 year ago

sherlock-admin commented 1 year ago

bin2chen

medium

getAccountPrimeDebtBalance() always return 0

Summary

Spelling errors that result in getAccountPrimeDebtBalance() Always return 0

Vulnerability Detail

getAccountPrimeDebtBalance() use for Show current debt

    function getAccountPrimeDebtBalance(uint16 currencyId, address account) external view override returns (
        int256 debtBalance
    ) {
        mapping(address => mapping(uint256 => BalanceStorage)) storage store = LibStorage.getBalanceStorage();
        BalanceStorage storage balanceStorage = store[account][currencyId];
        int256 cashBalance = balanceStorage.cashBalance;

        // Only return cash balances less than zero
        debtBalance = cashBalance < 0 ? debtBalance : 0;   //<------@audit wrong, Always return 0
    }

In the above code we can see that due to a spelling error, debtBalance always ==0 should use debtBalance = cashBalance < 0 ? cashBalance : 0;

Impact

getAccountPrimeDebtBalance() is the external method to check the debt If a third party integrates with notional protocol, this method will be used to determine whether the user has debt or not and handle it accordingly, which may lead to serious errors in the third party's business

Code Snippet

https://github.com/sherlock-audit/2023-03-notional/blob/main/contracts-v2/contracts/external/Views.sol#L496

Tool used

Manual Review

Recommendation

    function getAccountPrimeDebtBalance(uint16 currencyId, address account) external view override returns (
        int256 debtBalance
    ) {
        mapping(address => mapping(uint256 => BalanceStorage)) storage store = LibStorage.getBalanceStorage();
        BalanceStorage storage balanceStorage = store[account][currencyId];
        int256 cashBalance = balanceStorage.cashBalance;

        // Only return cash balances less than zero
-       debtBalance = cashBalance < 0 ? debtBalance : 0;
+       debtBalance = cashBalance < 0 ? cashBalance : 0;
    }
jeffywu commented 1 year ago

Fixed in: https://github.com/notional-finance/contracts-v2/pull/134

xiaoming9090 commented 1 year ago

@0xleastwood + @xiaoming9090 : Verified. Fixed in PR https://github.com/notional-finance/contracts-v2/pull/134