sherlock-audit / 2024-09-predict-fun-judging

5 stars 4 forks source link

valuevalk - Protocol does not factor for auto-rebasing mechanism of USDB #278

Open sherlock-admin4 opened 1 month ago

sherlock-admin4 commented 1 month ago

valuevalk

High

Protocol does not factor for auto-rebasing mechanism of USDB

Summary

Currently the protocol transfers raw USDB, however it does not factor that its an auto-rebasing token. This will lead to the lender losing the potential yield gained from holding USDB.

Vulnerability Detail

The implementation in PredictDotLoan.sol does not track USDB and yield gained but rather raw amounts. This means that during the time of the loan, the borrower will gain some yield of USDB, however he only has to return the amount he initially borrowed.

Impact

This leads to loss of yield for the Lender, which gave up his USDB tokens for the loan.

References: https://docs.blast.io/building/guides/weth-yield https://docs.blast.io/about-blast

Tool used

Manual Review

Recommendation

Factor the yield gain from holding USDB during the loan.