Submission Details
Severity:
Unrestricted Loan Repayment
Summary
The repay function allows any user to settle another's loan.
Vulnerability Detail
Without an explicit check, if a user mistakenly repays another's loan, they inadvertently lose tokens loanToken.
File: Lender.sol
IERC20(loan.loanToken).transferFrom(
msg.sender,
address(this),
loan.debt + lenderInterest
);
This design flaw exposes users to unintended financial consequences.
Impact
Users might accidentally repay someone else's loan, leading to unexpected financial losses.
Tools Used
A thorough review of the code base was conducted to identify this issue.
Recommendation
Add the following check:
if (loan.borrower == msg.sender) revert Unauthorized();
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.