Closed sherlock-admin3 closed 4 months ago
Invalid, users can simply choose not to borrow from this market, and market owners creating market won't get any attraction to borrow due to the high interest rates. There is no reason for them to do so.
Escalate The protocol can only create one loan pool for each token pair of Uniswap, and because of this, the protocol cannot create a loan pool for the corresponding asset. In the worst case, the core functions of the protocol are destroyed. Therefore, this issue is considered valid.
The escalation could not be created because you are not exceeding the escalation threshold.
You can view the required number of additional valid issues/judging contest payouts in your Profile page, in the Sherlock webapp.
Escalate The protocol can only create one loan pool for each token pair of Uniswap, and because of this, the protocol cannot create a loan pool for the corresponding asset. In the worst case, the core functions of the protocol are destroyed. Therefore, this issue is considered valid.
Escalate The protocol can only create one loan pool for each token pair of Uniswap, and because of this, the protocol cannot create a loan pool for the corresponding asset. In the worst case, the core functions of the protocol are destroyed. Therefore, this issue is considered valid.
The escalation could not be created because you are not exceeding the escalation threshold.
You can view the required number of additional valid issues/judging contest payouts in your Profile page, in the Sherlock webapp.
blockchain555
medium
The owner of the
LenderGroup_Smart
contract can maliciously deploy a non-lending pool or set an unfair interest rate.Summary
When deploying a pool because the max cap of
_interestRateLowerBound
and_interestRateUpperBound
in theLenderCommitmentGroup_Smart.sol#initialize()
function is not specified, a pool that cannot be loaned can be deployed or an unfair interest rate can be set.Vulnerability Detail
LenderGroup_Smart contract is a
pool
for lending principal tokens. This pool is deployed one for each token pair so that one poolShareToken is deployed for each token pair in Uniswap.And all parameters cannot be changed after they are set in the
initialize()
function because there are no functions that set the value of parameters.However, as you can see, the max cap of
interestRateLowerBound
andinterestRateUpperBound
is not checked, but only the condition of #L203 is checked. Therefore, a malicious distributor can set these two variables totype(uint16).max
to disable lending or intentionally set them high to receive unfair interest. 1.If these two variables are set totype(uint16).max
, the borrower can only setAPR
totype(uint16).max
. In this case, DOS occurs due to overflow of theV2Calculations.sol#calculatePaymentCycleAmount()
function, and therefore the borrower cannot execute thesubmitBid()
function.V2Calculations.sol#calculatePaymentCycleAmount():
As you can see, the decimal of ERC20 tokens is greater than 6, DOS is occured in the
percent()
function due to overflow.2.The deployer can also set these two variables arbitrarily, so he can set an unfair interest rate.
Impact
The owner of the
LenderGroup_Smart
contract can maliciously deploy a non-lending pool or set an unfair interest rate.Code Snippet
https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L158-L213
Tool used
Manual Review
Recommendation
Add the following line to the
initialize()
function.