Submission Details
Severity:
Incorrectly passing the loanId can lead to the person calling repay incurring a loss of loanToken
Summary
Perhaps the developer intended that the repaying individual can repay for anyone. The loanIds encompass a series of loans, but if the loanId is entered incorrectly, it may lead to paying for someone else's loan. Therefore, I believe here the collateral should be transferred to msg.sender, who is the person repaying, rather than the borrower.
Vulnerability Details
// transfer the collateral tokens from the contract to the borrower
IERC20(loan.collateralToken).transfer(
loan.borrower,
loan.collateral
);
Impact
lost of loanToken after invoking repay.
Tools Used
manual
Recommendations
// transfer the collateral tokens from the contract to the borrower
IERC20(loan.collateralToken).transfer(
- loan.borrower,
+ msg.sender,
loan.collateral
);
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.