Closed sherlock-admin2 closed 4 months ago
0xLogos
high
Any lender can set LenderCommitmentGroup_Smart as callback receiver in setRepaymentListenerForBid and break its internal accounting.
LenderCommitmentGroup_Smart
setRepaymentListenerForBid
In _repayLoan, callback is made to user controlled listener.
_repayLoan
address loanRepaymentListener = repaymentListenerForBid[_bidId]; // set by lender if (loanRepaymentListener != address(0)) { try ILoanRepaymentListener(loanRepaymentListener).repayLoanCallback{ gas: 80000 }( _bidId, _msgSenderForMarket(bid.marketplaceId), _payment.principal, _payment.interest ) {} catch {} }
LenderCommitmentGroup_Smart use this callback for internal accounting, but can be tricked to account for not owned loans.
function repayLoanCallback( uint256 _bidId, address repayer, uint256 principalAmount, uint256 interestAmount ) external onlyTellerV2 { totalPrincipalTokensRepaid += principalAmount; totalInterestCollected += interestAmount; }
LenderCommitmentGroup_Smart internal accounting for totalPrincipalTokensRepaid and totalInterestCollected is broken which can cause underflow in getTotalPrincipalTokensOutstandingInActiveLoans() and inflate getPoolTotalEstimatedValue()
totalPrincipalTokensRepaid
totalInterestCollected
getTotalPrincipalTokensOutstandingInActiveLoans()
getPoolTotalEstimatedValue()
https://github.com/sherlock-audit/2024-04-teller-finance/blob/defe55469a2576735af67483acf31d623e13592d/teller-protocol-v2-audit-2024/packages/contracts/contracts/TellerV2.sol#L1248-L1259
Manual Review
Do not allow setting LenderCommitmentGroup_Smart as listener
Duplicate of #42
0xLogos
high
LenderCommitmentGroup_Smart can be tricked to account for not owned loans payments
Summary
Any lender can set
LenderCommitmentGroup_Smart
as callback receiver insetRepaymentListenerForBid
and break its internal accounting.Vulnerability Detail
In
_repayLoan
, callback is made to user controlled listener.LenderCommitmentGroup_Smart
use this callback for internal accounting, but can be tricked to account for not owned loans.Impact
LenderCommitmentGroup_Smart
internal accounting fortotalPrincipalTokensRepaid
andtotalInterestCollected
is broken which can cause underflow ingetTotalPrincipalTokensOutstandingInActiveLoans()
and inflategetPoolTotalEstimatedValue()
Code Snippet
https://github.com/sherlock-audit/2024-04-teller-finance/blob/defe55469a2576735af67483acf31d623e13592d/teller-protocol-v2-audit-2024/packages/contracts/contracts/TellerV2.sol#L1248-L1259
Tool used
Manual Review
Recommendation
Do not allow setting
LenderCommitmentGroup_Smart
as listenerDuplicate of #42