search

sherlock-audit / 2023-04-jojo-judging

7 stars 4 forks source link

simon135 - If `Trate` is greater then `amount` when the user repays the funds wont be repayed #425

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

simon135

medium

If Trate is greater then amount when the user repays the funds wont be repayed

Summary

Since of rounding error when Trate is more than the user requested it will turn into 0 and nothing will get repaid but the user will send a small amount of funds

Vulnerability Detail

ex: Alice wants to repay 1 wei for its loan but Trate=1e19 so when 1e18/1e19=0 so it will subtract 0 and the transferFrom will transfer the 1 wei to the contract.

Impact

small loss of funds but with a bigger Trate it have bigger rounding error

Code Snippet

 } else {
            tBorrowAmount = amount;
            t0Amount = amount.decimalDiv(tRate);
        }
        IERC20(JUSD).safeTransferFrom(payer, address(this), tBorrowAmount);
        user.t0BorrowBalance -= t0Amount;
        t0TotalBorrowAmount -= t0Amount;

Tool used

Manual Review

Recommendation

check that if t0Amount is 0 that is reverts