Submission Details
Severity:
maxLoanRatio could be set to anything > 0
Summary
In Struct.sol, maxLoanRatio is said to be multiplied by 10**18, but it is not, and can be set to anything > 0 by the user with setPool() and updateMaxLoanRatio().
Vulnerability Details
maxLoanRatio is supposed to be set by the user to a uint256 multiplied by 10**18 but there is not check to ensure that so it can be set to anything > 0.
Impact
Wrong user input can lead to protocol malfunction.
Tools Used
Manual review
Recommendations
Add a proper check in setPool() and updateMaxLoanRatio() to ensure that the user is inputting the correct uint256.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.