Closed sherlock-admin3 closed 3 months ago
PoC requested from @BoRonG0d
Requests remaining: 9
Hi @nevillehuang
bad debt
I mentioned in my report do not need to profit from liquidation. arbitragers have simply acquired asset in Teller at a discounted price, and their time-based borrowing is still valid, even if they have become bad debt based on price.@BoRonG0d Can you provide me an indepth example of how the bad debt occurs here? Your issue is quite vague
BoRonGod
medium
Deviation in oracle price could lead to arbitrage in high LTV markets
Summary
Deviation in oracle price could lead to arbitrage in high LTV markets.
Vulnerability Detail
In
LenderCommitmentGroup_Smart
, the maximum amount a user can borrow is calculated with the conversion rate between two assets in a uniV3 pool:_calculateCollateralTokensAmountEquivalentToPrincipalTokens
is calculated by calling uniV3 oracle's observe()function, which returns a TWAP value.However, Uniwap V3 TWAP update is susceptible to front-running as their prices tend to lag behind an asset's real-time price. (More specifically: Uniwap V3 TWAP returns the average price over the past X number of blocks, which means it will always lag behind the real-time price.)
For Teller, this becomes profitable when the price deviation is sufficiently large for an attacker to open positions that become bad debt.
Impact
All profit gained from arbitrage causes a loss of funds for lenders as the remaining bad debt is socialized by them.
Code Snippet
https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L634-L663
Tool used
Manual Review
Recommendation
Consider implementing a borrowing fee to mitigate against arbitrage opportunities. Ideally, this fee would be larger than the oracle's maximum price deviation so that it is not possible to profit from arbitrage.
Multiple solutions may be studied:
Further possible mitigations have also been explored by other protocols: • Angle Protocol: Oracles and Front-Running • Liquity: The oracle conundrum