Submission Details
Severity:
The `minLoanSize` set in the pool config can be passby via buyLoan operation
Summary
buyLoan operation can passby the limit of minLoanSize
Vulnerability Details
buyLoan not check target pool's minLoanSize.
I write a test case:
function testBuyLoanMinDebSizetLimit() public {
loanToken.approve(address(lender), type(uint256).max);
vm.prank(borrower);
loanToken.approve(address(lender), type(uint256).max);
vm.prank(lenderAlice);
loanToken.approve(address(lender), type(uint256).max);
//create a pool.
Pool memory pool;
pool.lender = address(this);
pool.loanToken = address(loanToken);
pool.collateralToken = address(colToken);
pool.minLoanSize = 1; //with a small loansize.
pool.poolBalance = totalSupply;
pool.maxLoanRatio = 10e18; // 1:1
pool.auctionLength = 3 days;
pool.interestRate = 1;
bytes32 poolId = lender.setPool(pool);
Borrow[] memory borrows = new Borrow[](1);
borrows[0].poolId = poolId;
borrows[0].debt = totalSupply;
borrows[0].collateral = totalSupply;
//borrower borrow token from pool.
vm.prank(borrower);
colToken.approve(address(lender), type(uint256).max);
vm.prank(borrower);
lender.borrow(borrows);
//lender start action.
uint256[] memory loanIds = new uint256[](1);
loanIds[0] = 0;
lender.startAuction(loanIds);
vm.warp(block.timestamp + 1 days);
//lenderAlice zapBuyLoan a loan.
pool.lender = address(lenderAlice);
pool.loanToken = address(loanToken);
pool.collateralToken = address(colToken);
pool.minLoanSize = 100e18; //with a big loansize.
pool.poolBalance = totalSupply * 2;
pool.maxLoanRatio = 10e18; // 1:1
pool.auctionLength = 1 days;
pool.interestRate = 1;
vm.prank(lenderAlice);
lender.zapBuyLoan(pool,0);
uint256 totalDebt = lender.getLoanDebt(0);
assert(totalDebt<pool.minLoanSize);
}
Impact
pool's minLoanSize setting been passby
Tools Used
foundry
Recommendations
check minLoanSize while invoking buyLoan
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.