Escrowed repayments belonging to the lender commitment contract can’t be retrieved from the escrow vault
Summary
Escrowed repaid assets corresponding to the lender commitment contract can never be retrieved because the lender commitment does not implement a way to interact with the escrow to obtain the funds.
Vulnerability Detail
TellerV2 implements a safety mechanism to prevent ERC20 token transfers that fail from Dos’ing repayments. This is done inside the _sendOrEscrowFunds function, where if the transfer of repaid assets to the lender fails, assets will be deposited to the escrow vault so that the lender can later retrieve them:
The LenderCommitmentGroup_Smart operates as a lender in TellerV2. Its pooled assets can be lent out to borrowers by creating new loans, and borrowers can then repay their assets back to the LenderCommitmentGroup_Smart contract.
If one of those token transfer fails when repaying back to LenderCommitmentGroup_Smart (maybe because that specific lendingToken performs gas-intensive transfers that cost more than 100000 units of gas), then the tokens will be deposited into the escrow vault on behalf of LenderCommitmentGroup_Smart. The only way to recover the assets from the escrow vault is to call its withdraw function being the msg.sender who actually has had the funds deposited:
The problem is that the LenderCommitmentGroup_Smart does not have a way to call the withdraw function in the EscrowVault contract. Because of this, all repaid assets to the LenderCommitmentGroup_Smart contract that have failed and have been sent to the escrow vault will be unrecoverable, and will remain in the escrow vault forever.
Impact
High. If a token transfer fails when repaying a loan to the LenderCommitmentGroup_Smart contract (which is a possible scenario explicitly handled in _sendOrEscrowFunds), the funds will remain locked forever in the escrow vault. This will make the LenderCommitmentGroup_Smart contract insolvent, and liquidity providers in the LenderCommitmentGroup_Smart will never be able to retrieve their assets.
0xadrii
high
Escrowed repayments belonging to the lender commitment contract can’t be retrieved from the escrow vault
Summary
Escrowed repaid assets corresponding to the lender commitment contract can never be retrieved because the lender commitment does not implement a way to interact with the escrow to obtain the funds.
Vulnerability Detail
TellerV2 implements a safety mechanism to prevent ERC20 token transfers that fail from Dos’ing repayments. This is done inside the
_sendOrEscrowFunds
function, where if the transfer of repaid assets to the lender fails, assets will be deposited to the escrow vault so that the lender can later retrieve them:The
LenderCommitmentGroup_Smart
operates as a lender in TellerV2. Its pooled assets can be lent out to borrowers by creating new loans, and borrowers can then repay their assets back to theLenderCommitmentGroup_Smart
contract.If one of those token transfer fails when repaying back to
LenderCommitmentGroup_Smart
(maybe because that specificlendingToken
performs gas-intensive transfers that cost more than 100000 units of gas), then the tokens will be deposited into the escrow vault on behalf ofLenderCommitmentGroup_Smart
. The only way to recover the assets from the escrow vault is to call itswithdraw
function being themsg.sender
who actually has had the funds deposited:The problem is that the
LenderCommitmentGroup_Smart
does not have a way to call thewithdraw
function in theEscrowVault
contract. Because of this, all repaid assets to theLenderCommitmentGroup_Smart
contract that have failed and have been sent to the escrow vault will be unrecoverable, and will remain in the escrow vault forever.Impact
High. If a token transfer fails when repaying a loan to the LenderCommitmentGroup_Smart contract (which is a possible scenario explicitly handled in _sendOrEscrowFunds), the funds will remain locked forever in the escrow vault. This will make the LenderCommitmentGroup_Smart contract insolvent, and liquidity providers in the LenderCommitmentGroup_Smart will never be able to retrieve their assets.
Code Snippet
https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/TellerV2.sol#L887
https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/TellerV2.sol#L911
https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/TellerV2.sol#L942
Tool used
Manual Review
Recommendation
Add a function in the LenderCommitmentGroup_Smart contract that allows funds to be pulled from the Escrow Vault.
Duplicate of #126