Submission Details
Severity:
Lack of `maxLoanRatio` validation in `buyLoan()`
Summary
Lenders might buy a loan that has a higher loanRatio than their maxLoanRatio.
Vulnerability Details
Lenders can buy a loan under the auction using buyLoan().
function buyLoan(uint256 loanId, bytes32 poolId) public {
// get the loan info
Loan memory loan = loans[loanId];
// validate the loan
if (loan.auctionStartTimestamp == type(uint256).max)
revert AuctionNotStarted();
if (block.timestamp > loan.auctionStartTimestamp + loan.auctionLength)
revert AuctionEnded();
// calculate the current interest rate
uint256 timeElapsed = block.timestamp - loan.auctionStartTimestamp;
uint256 currentAuctionRate = (MAX_INTEREST_RATE * timeElapsed) /
loan.auctionLength;
// validate the rate
if (pools[poolId].interestRate > currentAuctionRate) revert RateTooHigh();
// calculate the interest
(uint256 lenderInterest, uint256 protocolInterest) = _calculateInterest(
loan
);
...
}
But it doesn't validate the maxLoanRatio requirement which is checking in other functions.
As a result, lenders might buy a bad loan that has a dangerous loan ratio.
Impact
Lenders might buy a bad loan unexpectedly.
Tools Used
Manual Review
Recommendations
buyLoan() should validate maxLoanRatio.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.