Submission Details
Severity:
Double accounting for pool balance in a refinance
Summary
There is double accounting problem for pool balance in a refinance.
Vulnerability Details
A pool would be refinanced to by a loan if it provides better offer to the loan.
Refinance is done by refinance method, the loan debt will be added to pool's outstandingLoans and pool balance will be reduced by loan debt as well.
However, pool balance is reduced by loan debt twice in the method.
First time:
_updatePoolBalance(poolId, pools[poolId].poolBalance - debt);
pools[poolId].poolBalance -= debt;
This is obviouly wrong and pool balance is not correctly accounted.
Impact
Loss of funds.
Tools Used
Manual Review
Recommendations
To account correlty, pool balance should only be reduced by loan debt once.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.