User can still withdrawAtMaturity or repayAtMaturity 0 positionAssets by inputting positive positionAssets if his position balance is 0.

Low/Info issue submitted by Emmanuel

Summary

The check for 0 withdraw amount is not effective

Vulnerability Detail

It would get scaled down to 0 within the function line: https://github.com/sherlock-audit/2024-04-interest-rate-model/blob/main/protocol/contracts/Market.sol#L379

the check for 0 withdraw amount is not so effective:

  function withdrawAtMaturity(
    uint256 maturity,
    uint256 positionAssets,
    uint256 minAssetsRequired,
    address receiver,
    address owner
  ) external whenNotPaused returns (uint256 assetsDiscounted) {
    if (positionAssets == 0) revert ZeroWithdraw();
    ...
    if (positionAssets > position.principal + position.fee) positionAssets = position.principal + position.fee;//@audit positionAssets can get scaled to 0 here
    ...

Impact

the check for 0 withdraw amount is not so effective

Code Snippet

https://github.com/sherlock-audit/2024-04-interest-rate-model/blob/main/protocol/contracts/Market.sol#L379

Tool used

Manual Review

Recommendation

The if (positionAssets == 0) revert ZeroWithdraw(); check should be done after the scaling

sherlock-audit / 2024-04-interest-rate-model-judging

User can still withdrawAtMaturity or repayAtMaturity 0 positionAssets by inputting positive positionAssets if his position balance is 0. #263