During the rolloverLoanWithFlash function call, the borrower repays the previous loan using borrowed principal tokens with an Aave simple flash loan. Here is how the _repayLoanFull function looks:
A malicious borrower can cause a Denial of Service (DOS) attack on all future rolloverLoanWithFlash executions with the KNS token as the principal token for other borrowers. This can be achieved by borrowing from an Aave flash loan with an amount of owedPrincipal + interest + 1 wei KNS of borrower's bid. After a successful execution, the borrower leaves an allowance of 1 wei, creating a DOS situation.
It is necessary to call ITellerV2(TELLER_V2).calculateAmountOwed(_bidId, block.timestamp) to calculate the total amount owed for a loan bid at a specific timestamp and approve it.
merlin
medium
DOS vulnerability in the rolloverLoanWithFlash function in FlashRolloverLoan_G5.sol
Summary
https://github.com/d-xo/weird-erc20#approval-race-protections Some tokens (e.g. KNC) do not allow approving an amount M > 0 when an existing amount N > 0 is already approved.
Note
: The KNC token returns true for thetransfer and transferFrom
functions. Comment from the previous Teller audit: https://github.com/sherlock-audit/2023-03-teller-judging/issues/423#issuecomment-1535401214Vulnerability Detail
During the
rolloverLoanWithFlash
function call, the borrower repays the previous loan using borrowed principal tokens with an Aave simple flash loan. Here is how the_repayLoanFull
function looks:A malicious borrower can cause a Denial of Service (DOS) attack on all future
rolloverLoanWithFlash
executions with the KNS token as the principal token for other borrowers. This can be achieved by borrowing from an Aave flash loan with an amount ofowedPrincipal + interest + 1 wei
KNS of borrower's bid. After a successful execution, the borrower leaves an allowance of 1 wei, creating a DOS situation.Impact
A malicious borrower can cause a Denial of Service (DOS) attack on all future
rolloverLoanWithFlash
executions for non-zero approve tokens.Code Snippet
contracts/contracts/LenderCommitmentForwarder/extensions/FlashRolloverLoan_G5.sol#L243-L246
Tool used
Manual Review
Recommendation
It is necessary to call
ITellerV2(TELLER_V2).calculateAmountOwed(_bidId, block.timestamp)
to calculate the total amount owed for a loan bid at a specific timestamp and approve it.Duplicate of #140