Closed sherlock-admin3 closed 5 months ago
request poc
This issue lacks details to prove how the state can be reached without risking prior liquidation?
PoC requested from @spacegliderrrr
Requests remaining: 10
This doesnt make sense . While your statement is true, game theory suggests that someone else would have liquidated the loan before them if it was profitable to do so (assuming perfect knowledge and access)
Furthermore, as soon as liquidateDefaultedLoanWithIncentive becomes callable, there is a 800% penalty on it which decreases slowly overtime
Escalate
Should be dup of #121
Escalate
Should be dup of #121
You've created a valid escalation!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
This issue is arguable. The majority of the issue's description (Summary, Impact and Recommendation) is incorrect except the following sentence:
When calling liquidateDefaultedLoanWithIncentive within LenderCommitmentGroup_Smart, the accrued fees are ignored and user has to only pay based on their principal amount.
One can argue the impact and rootcause is wrongly described, given the watson highlighted the problem as the following:
The problem occurs in the case where the user's interest is more than their principal, meaning that as soon as liquidateDefaultedLoanWithIncentive becomes callable
I will leave it to @cvetanovv to decide, but I personally believe this issue should remain invalid based on the following
In addition to this, there is a submission D which identifies the core issue but does not clearly describe the impact or an attack path. Then D is considered low.
I agree with @nevillehuang comment.
The root of this issue is that the user can liquidate himself for profit, which is fundamentally different from the root cause of #121. What they have in common is that liquidation does not account for the interest. Everything else is different, and as the Lead Judge has pointed out, under Sherlock rules, this issue is invalid.
Planning to reject the escalation and leave the issue as is.
Result: Invalid Unique
bughuntoor
medium
In case the user's interest is more than their principal, they can wait to
liquidateDefaultedLoanWithIncentive
for profitSummary
If the user has taken a loan from
LenderCommitmentGroup_Smart.sol
and the interest is more than their principal, they can wait toliquidateDefaultedLoanWithIncentive
for profitVulnerability Detail
When calling
liquidateDefaultedLoanWithIncentive
withinLenderCommitmentGroup_Smart
, the accrued fees are ignored and user has to only pay based on their principal amount.The problem occurs in the case where the user's interest is more than their principal, meaning that as soon as
liquidateDefaultedLoanWithIncentive
becomes callable, they can call it and pay 2x their principal (which would still be less than what they would pay) and claim back their collateral.Impact
Users can liquidate themselves for profit.
Code Snippet
https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L422C1-L439C11
Tool used
Manual Review
Recommendation
add proper incentivization for users to repay their loans instead of liquidating themselves.