20,000 USDC
View results
Submission Details
Severity: gas
Valid

Lender.sol: The error being `PoolConfig` in most cases is completely a downside of protocol as users can't know the reasons to why their transaction failed

Summary

There are 7 instances of PoolConfig being used as the revert message in Lender.sol this seems like an unnecessary complexity that actually leads to users not understanding why exactly their transaction is not going through

Vulnerability Details

See Summary. additionally take these instances as an example:
Lender.sol#L146

// you can't change the outstanding loans
if (p.outstandingLoans != pools[poolId].outstandingLoans)
revert PoolConfig();

Lender.sol#L198-L201

function removeFromPool(bytes32 poolId, uint256 amount) external {
if (pools[poolId].lender != msg.sender) revert Unauthorized();
if (amount == 0) revert PoolConfig();

As seen the first revert happens in a case where the provided outstanding loans is not same as whst's been stored in the contract, whereas the second instance is a revert happening if the attempted removal is of amount = 0, but in both instances the reverted error message is poolConfig which just seems too vague and could easily lead to confusion.

Impact

Users hardship while interacting with protocol as they would have a hard time trying to find out what's wrong with their attempted function executions

Tools Used

Manual Audit

Recommend Mitigation

Error messages should clearly indicate why a transaction has reverted, I recommend this mechanism to be implemented in the protocol

Additional Note

There is an incomplete code explanation comment at L442 of Lender.sol, it states that validate the loan whereas the validation being made in the next line is for the loan's lender, so lender should be added to the comment.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!