Submission Details
Severity:
Malicious lender can lend a loan with maximum interest rate by front-running
Summary
Malicious lender can lend a loan with maximum interest rate by front-running.
Vulnerability Details
Pool interest rate can be updated through updateInterestRate method by the lender.
function updateInterestRate(bytes32 poolId, uint256 interestRate) external {
if (pools[poolId].lender != msg.sender) revert Unauthorized();
if (interestRate > MAX_INTEREST_RATE) revert PoolConfig();
pools[poolId].interestRate = interestRate;
emit PoolInterestRateUpdated(poolId, interestRate);
}
A malicious lender can update the interest rate to MAX_INTEREST_RATE by front-running a borrower, leading to the borrower taking a loan with maximum interest rate.
Impact
Borrower may have to pay much more interest before realizing the problem.
Tools Used
Manual Review
Recommendations
Please consider to allowing borrower to specify interest rate when borrows a loan.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.