Submission Details
Severity:
if the token has a callback then funds will be lost
Summary
If ERC20 is used that has callback we can reenter and not pay for tokens and it increases poolBalance
Vulnerability Details
If the token has beforeHook then we can reenter and inflate poolBalance without giving funds
if (pools[poolId].lender != msg.sender) revert Unauthorized();
if (amount == 0) revert PoolConfig();
_updatePoolBalance(poolId, pools[poolId].poolBalance + amount);
// transfer the loan tokens from the lender to the contract
// @audit here we can reenter and cause the pool balance to update and then add 1 wei getting loan collateral for free
IERC20(pools[poolId].loanToken).transferFrom(
msg.sender,
address(this),
amount
);
Impact
The lender will make loan tokens out of thin air stealing other loan tokens from other lenders and then getting the borrowers collateral
Tools Used
Recommendations
use the checks and effects pattern, transfer tokens before the update (note: only do this addToPool)
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.