Using wrong selector will dos FlashRolloverLoan's accept commitment
Summary
The _acceptCommitment function will always fail if _commitmentArgs.smartCommitmentAddress != address(0) because the call forwarded uses a wrong selector.
Vulnerability Detail
The FlashRolloverLoan_G5 contract allows calling the smartcommitmentforwarder’s acceptCommitmentWithRecipient via its internal _acceptCommitment function:
The problem is that the call to the smart commitment forwarded is performed with the ISmartCommitmentForwarder.acceptSmartCommitmentWithRecipient.selector, given by the ISmartCommitmentForwarder interface:
This is wrong because the smart commitment forward contract doesn’t have a acceptSmartCommitmentWithRecipient. Instead, it only has a acceptCommitmentWithRecipient function. Because of this, all the calls made to the smart commitment forwarder will fail, given that no function with the selector given by the acceptSmartCommitmentWithRecipient will be found.
Impact
Medium. The functionality allowing to interact with the smart commitment forwarder in the FlashRolloverLoan_G5 contract will never work and always revert.
0xadrii
medium
Using wrong selector will dos FlashRolloverLoan's accept commitment
Summary
The _acceptCommitment function will always fail if _commitmentArgs.smartCommitmentAddress != address(0) because the call forwarded uses a wrong selector.
Vulnerability Detail
The
FlashRolloverLoan_G5
contract allows calling the smartcommitmentforwarder’sacceptCommitmentWithRecipient
via its internal_acceptCommitment
function:The problem is that the call to the smart commitment forwarded is performed with the
ISmartCommitmentForwarder.acceptSmartCommitmentWithRecipient.selector
, given by theISmartCommitmentForwarder
interface:This is wrong because the smart commitment forward contract doesn’t have a
acceptSmartCommitmentWithRecipient
. Instead, it only has aacceptCommitmentWithRecipient
function. Because of this, all the calls made to the smart commitment forwarder will fail, given that no function with the selector given by theacceptSmartCommitmentWithRecipient
will be found.Impact
Medium. The functionality allowing to interact with the smart commitment forwarder in the FlashRolloverLoan_G5 contract will never work and always revert.
Code Snippet
https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/FlashRolloverLoan_G5.sol#L291-L293
Tool used
Manual Review
Recommendation
Update the interface and call used so that the function can be properly forwarded.
Duplicate of #135