Submission Details
Severity:
You can buy loan less than minLoanSize specified by the pool
Summary
You can buy loan less than the minLoanSize specified in the pool in the buyLoan function of Lender contract.
Vulnerability Details
There is a minimum limit to which you can buy a loan from a pool which is set as pool.minLoanSize. But while buying loan from the auction, there is no check for this case.
Impact
The pool.minLoanSize is set in the first place to prevent griefing as mentioned in the Structs.sol for struct Pool.
Tools Used
Manual Analysis
Recommendations
Add the following check if (totalDebt < pools[poolId].minLoanSize) revert LoanTooSmall(); after the line:
/src/Lender.sol
486: if (pools[poolId].poolBalance < totalDebt) revert PoolTooSmall();
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.