KupiaSec - The collateral tokens withdrawn `by liquidateDefaultedLoanWithIncentive()` will be frozen in the `LenderCommitmentGroup_Smart` contract. #229
The collateral tokens withdrawn by liquidateDefaultedLoanWithIncentive() will be frozen in the LenderCommitmentGroup_Smart contract.
Summary
TellerV2.lenderCloseLoanWithRecipient() always transfers the collateral to the lender, and the LenderCommitmentGroup_Smart contract is not designed to handle or manage the collateral tokens directly. So, the collateral tokens withdrawn by liquidateDefaultedLoanWithIncentive() will be frozen in the LenderCommitmentGroup_Smart contract.
Vulnerability Detail
The collateral tokens withdrawn by liquidateDefaultedLoanWithIncentive() is sent to the LenderCommitmentGroup_Smart contract.
function liquidateDefaultedLoanWithIncentive(
uint256 _bidId,
int256 _tokenAmountDifference
) public bidIsActiveForGroup(_bidId) {
[...]
@> ITellerV2(TELLER_V2).lenderCloseLoanWithRecipient(_bidId, msg.sender);
}
Because TellerV2.lenderCloseLoanWithRecipient() always transfers the collateral to the lender. Actually, the _lenderCloseLoanWithRecipient() function don't use the _collateralRecipient at all. So all collaterals are sent to the lender, which is the LenderCommitmentGroup_Smart contract.
However, the LenderCommitmentGroup_Smart contract is not designed to handle or manage the collateral tokens. As a result, all collateral tokens will be frozen in it.
Impact
The collateral tokens withdrawn by liquidateDefaultedLoanWithIncentive() will be frozen in the LenderCommitmentGroup_Smart contract.
KupiaSec
high
The collateral tokens withdrawn
by liquidateDefaultedLoanWithIncentive()
will be frozen in theLenderCommitmentGroup_Smart
contract.Summary
TellerV2.lenderCloseLoanWithRecipient()
always transfers the collateral to the lender, and theLenderCommitmentGroup_Smart
contract is not designed to handle or manage the collateral tokens directly. So, the collateral tokens withdrawnby liquidateDefaultedLoanWithIncentive()
will be frozen in theLenderCommitmentGroup_Smart
contract.Vulnerability Detail
The collateral tokens withdrawn
by liquidateDefaultedLoanWithIncentive()
is sent to theLenderCommitmentGroup_Smart
contract.https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L422-L472
Because
TellerV2.lenderCloseLoanWithRecipient()
always transfers the collateral to the lender. Actually, the_lenderCloseLoanWithRecipient()
function don't use the_collateralRecipient
at all. So all collaterals are sent to the lender, which is theLenderCommitmentGroup_Smart
contract.https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/TellerV2.sol#L738-L774
However, the
LenderCommitmentGroup_Smart
contract is not designed to handle or manage the collateral tokens. As a result, all collateral tokens will be frozen in it.Impact
The collateral tokens withdrawn by
liquidateDefaultedLoanWithIncentive()
will be frozen in theLenderCommitmentGroup_Smart
contract.Code Snippet
https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/TellerV2.sol#L745-L774
https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L422-L472
Tool used
Manual Review
Recommendation
Collateral should be sent to the
_collateralRecipient
inTellerV2.lenderCloseLoanWithRecipient()
.Duplicate of #46