Invalid implementation of function LenderCommitmentGroup_Smart.sol#liquidateDefaultedLoanWithIncentive()
Summary
Due to incorrect implementation of the LenderCommitmentGroup_Smart.sol#liquidateDefaultedLoanWithIncentive() function, the liquidator can seize the borrower's collateral free of charge.
Vulnerability Detail
In the LenderCommitmentGroup_Smart.sol#liquidateDefaultedLoanWithIncentive() function, the following operations are performed when _tokenAmountDifference <= 0.
27 hours after loan default, minAmountDifference returns -amountDue.
function getMinimumAmountDifferenceToCloseDefaultedLoan(
uint256 _amountOwed,
uint256 _loanDefaultedTimestamp
) public view virtual returns (int256 amountDifference_) {
require(
_loanDefaultedTimestamp > 0,
"Loan defaulted timestamp must be greater than zero"
);
require(
block.timestamp > _loanDefaultedTimestamp,
"Loan defaulted timestamp must be in the past"
);
506: uint256 secondsSinceDefaulted = block.timestamp -
507: _loanDefaultedTimestamp;
509: int256 incentiveMultiplier = int256(86400) -
510: int256(secondsSinceDefaulted);
512: if (incentiveMultiplier < -10000) {
513: incentiveMultiplier = -10000;
514: }
516: amountDifference_ =
517: (int256(_amountOwed) * incentiveMultiplier) /
518: int256(10000);
}
Therefore, if the liquidator sets the tokenAmountDifference to minAmountDifference, according to #L459 to #L463, the liquidator does not transfer funds.
amountDue - tokensToGiveToSender = 0
The TellerV2.sol#liquidateLoanFull() function is called 24 hours after loan default.
When calling this function, the liquidator pays principal + interest to the lender and .
However, due to the function implemented in above, the liquidator can seize the collateral free of charge without paying the corresponding principal.
Impact
The liquidator can seize the collateral free of charge without paying the corresponding principal.
blockchain555
high
Invalid implementation of function
LenderCommitmentGroup_Smart.sol#liquidateDefaultedLoanWithIncentive()
Summary
Due to incorrect implementation of the
LenderCommitmentGroup_Smart.sol#liquidateDefaultedLoanWithIncentive()
function, the liquidator can seize the borrower's collateral free of charge.Vulnerability Detail
In the
LenderCommitmentGroup_Smart.sol#liquidateDefaultedLoanWithIncentive()
function, the following operations are performed when_tokenAmountDifference <= 0
.27 hours after loan default,
minAmountDifference
returns-amountDue
.Therefore, if the liquidator sets the
tokenAmountDifference
tominAmountDifference
, according to #L459 to #L463, the liquidator does not transfer funds.The
TellerV2.sol#liquidateLoanFull()
function is called 24 hours after loan default. When calling this function, the liquidator paysprincipal + interest
to the lender and . However, due to the function implemented in above, the liquidator can seize the collateral free of charge without paying the corresponding principal.Impact
The liquidator can seize the collateral free of charge without paying the corresponding principal.
Code Snippet
https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L422-L472
Tool used
Manual Review
Recommendation
It is recommended that liquidators only call the
TellerV2.sol#liquidateLoanFull()
function after 24 hours of loan default.