search

sherlock-audit / 2024-09-predict-fun-judging

0 stars 0 forks source link

Wonderful Ceramic Bat - batch refinancing in ` refinance` can be DOS'd by users toggling `toggleAutoRefinancingEnabled` #286

Open sherlock-admin3 opened 2 days ago

sherlock-admin3 commented 2 days ago

Wonderful Ceramic Bat

Medium

batch refinancing in refinance can be DOS'd by users toggling toggleAutoRefinancingEnabled

Summary

Batch refinancing allows operators with the REFINANCIER_ROLE to replace existing loans with a new one, potentially under more favorable terms, such as a lower interest rate or different lender. However users have the right to enable or disable this using toggleAutoRefinancingEnable different users can disable this feature at different times to make this function inoperable.

Root Cause

in PredictDotLoan:693 users can toggle autorefinancing at any time.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. operator with REFINANCIER_ROLE can call the refinance function here: https://github.com/sherlock-audit/2024-09-predict-fun/blob/main/predict-dot-loan/contracts/PredictDotLoan.sol#L500-L514

  2. However users that toggle this just before the function call cause it to fail, meaning loans in the entire array cannot be refinanced. https://github.com/sherlock-audit/2024-09-predict-fun/blob/main/predict-dot-loan/contracts/PredictDotLoan.sol#L693-L697

Impact

loans cannot be refinanced in batches, because they will revert for every loan that disables autorefinancing

PoC

No response

Mitigation

Add some interval between toggle refinancing to prevent it from being abused.