20,000 USDC
View results
Submission Details
Severity: high
Valid

borrower can sweep the pool entirely when loanToken and collateral have different precision

The formulaes should be adjusted for token precision differences

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L246

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L384

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L618

maxLoanRatio is not respected when loanToken and collateral have different precisions, i.e
loanToken is wbtc and collateralToken is weth

uint256 loanRatio = (debt * 10 ** 18) / collateral

It's not clearly stated how maxLoanRatio translates to percentages but protocol developers use 10 ** 18 in the tests a lot.

In the case of WBTC and WETH the result will be much smaller than 10 ** 18 which allows an attacker to steal the funds.

Mitigation steps:

uint constant BPS = 10000;

uint256 loanRatio = (debt * 10 ** collateral.precision() * BPS) / (collateral * debt.precision());

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.