Submission Details
Severity:
refinance() function causing incorrect pool balance update
Summary
The refinance(Refinance[] calldata refinances) function in the contract Lender has an error to update the pool balance.
Vulnerability Details
The new pool balance the loan refinanced to is updated in L636:
_updatePoolBalance(poolId, pools[poolId].poolBalance - debt);
And is updated again at L698:
pools[poolId].poolBalance -= debt;
Results in double accounting of the pool balance.
Impact
The impact of this vulnerability is severe, leading to financial losses for the pool lender.
Tools Used
Manual Review
Recommendations
To fix this vulnerability, the L698 should be removed.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.