search

sherlock-audit / 2024-09-predict-fun-judging

5 stars 4 forks source link

Tangy Coconut Python - refinance is not protected against frontrunning #339

Closed sherlock-admin2 closed 1 month ago

sherlock-admin2 commented 1 month ago

Tangy Coconut Python

Low/Info

refinance is not protected against frontrunning

Summary

a user could cause a refinance call by the keeper to revert by frontrunning a call to opt themselves out of auto refinancing https://github.com/sherlock-audit/2024-09-predict-fun/blob/main/predict-dot-loan/contracts/PredictDotLoan.sol#L504-L514

Root Cause

No response

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

waste of gas on the part of the protocol and loans would not be refinanced at the right time

PoC

No response

Mitigation

the above code could be done like this instead 

   address borrower = loan.borrower;
 if (autoRefinancingEnabled[borrower] == 0) continue;
 Refinancing calldata refinancing = refinancings[i];
  (uint256 id, Loan memory loan, uint256 protocolFee) = _refinance(refinancing);