20,000 USDC
View results
Submission Details
Severity: low
Valid

`Lender` should not calculate and transfer protocol fees when `lenderFee` or `borrowerFee` is equal to zero or when `feeReceiver` is equal to `address(0)`

Summary

There are three specific cases where the Lender contracts should skip the fee calculation and avoid calling IERC20(token).transfer(feeReceiver, amountOfFees):

  1. When feeReceiver is equal to address(0) fee calculation and fee transfer should be skipped even if the fee amount would be greater than zero (this would be the case when lenderFee or borrowerFee are greater than zero)

  2. When borrowerFee is equal to 0 the fee calculation and transfer should be skipped in the functions borrow, seizeLoan and refinance

  3. When lenderFee is equal to 0 the fee calculation and transfer should be skipped in the functions repay, giveLoan and buyLoan and refinance

Additional note for the first point (I submitted a separate issue with more detail). Sending fees to address(0) will lead to two possible outcomes

  • Even if those fees are deducted from the lender/borrower, they will be burned and not gained by the protocol

  • If the ERC20 token from which the protocol calls transfer or transferFrom does not accept the to argument equal to address(0) as a valid value, the ERC20 token will revert, breaking the Lender contract logic.

Recommendations

The protocol should consider skipping the calculation and transfer of the protocol fees when lenderFee or borrowerFee is equal to zero in the specific point of the code.

The protocol should handle correctly the case where feeReceiver is equal to address(0) to avoid breaking the protocol itself or burning those fees by sending them to address(0).

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!