sherlock-audit / 2024-02-leverage-contracts-judging

1 stars 0 forks source link

the-first-elder - Creditors will Loose harvest if a user repays their loan before they can claim harvest #24

Closed sherlock-admin2 closed 6 months ago

sherlock-admin2 commented 6 months ago

the-first-elder

high

Creditors will Loose harvest if a user repays their loan before they can claim harvest

Summary

If a user repays their loan before creditors can claim harvest, creditors will lose harvest rewards.

Vulnerability Detail

When a user repays their loan before creditors can, the borrowing key associated with the user loan is deleted. Consequently, the harvest function cannot be invoked, preventing creditors from claiming harvest rewards.

Impact

This vulnerability results in a loss of profit for creditors who expected to receive harvest rewards.

Code Snippet

https://github.com/sherlock-audit/2024-02-leverage-contracts/blob/main/wagmi-leverage/contracts/LiquidityBorrowingManager.sol#L579

https://github.com/sherlock-audit/2024-02-leverage-contracts/blob/main/wagmi-leverage/contracts/LiquidityBorrowingManager.sol#L499

Tool used

Manual Review

Recommendation

Allow the harvest function to be invoked even when a user repays their debt. This adjustment ensures that creditors can claim harvest rewards regardless of the timing of loan repayments and harvest claims, thereby preventing loss of profit.

nevillehuang commented 6 months ago

Invalid, during repayment, all fees are paid as stored as seen here. Where in it is charged when restoring liquidity here. Additionally, this issue lacks sufficient proof.