Submission Details
Severity:
should restrict oldPoolId ≠ new poolId
Summary
should restrict oldPoolId ≠ new poolId
Vulnerability Details
For example, in the giveLoan function, the loan can be transferred to a new pool, but it is not checked whether the new pool is the same as the old pool. If it is the same poolid, then there will be problems.
// newpool
pools[poolId].outstandingLoans += totalDebt; // loan.debt + lenderInterest + protocolInterest
// oldpool
pools[oldPoolId].outstandingLoans -= loan.debt;
Actually pools[poolid].outstandingLoans += lenderInterest + protocolInterest
Impact
Relatively speaking, the pool has not been migrated, but outstandingLoans has been updated
Tools Used
vscode
Recommendations
It is recommended to judge that oldPoolId ≠ new poolId
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.