valuevalk - Borrower can DoS and cause off-chain system big gas costs due to callback function from ERC1155

[sherlock-admin4]

valuevalk

High

Borrower can DoS and cause off-chain system big gas costs due to callback function from ERC1155

Summary

Borrower can temporary DoS the off-chain mechanism and gas-grief it causing it to spend more for transaction fees.

Vulnerability Detail

ERC1155 tokens used for collateral in the PredictDotLoan.sol have a callback onERC1155Received that will be called during a transfer. The receiver ( the borrower ) can intentionally enable auto-refinance and cost the off-chain mechanism to fail temporary and gas grief it.

The following function is called in _refinance() which contains the call with the ERC1155 tokens.

    function _transferExcessCollateralIfAny(
        uint256 positionId,
        address receiver,
        uint256 collateralAmountRequired,
        uint256 actualCollateralAmount
    ) private {
        uint256 excessCollateral = actualCollateralAmount - collateralAmountRequired;

        if (excessCollateral > 0) {
@>>         CTF.safeTransferFrom(address(this), receiver, positionId, excessCollateral, "");
        }
    }

Impact

Since the off-chain mechanism is trusted we can assume that he will handle this correctly and remove the borrower from the next batch call for refinance, however it would still lead to temporary DoS and gas grief.

Tool used

Manual Review