Submission Details
Severity:
Lender can sell borrower's anytime, make borrower can't take back the collateral token
Summary
Lender can sell borrower's anytime, make borrower can't take back the collateral token
Vulnerability Details
Lender can startAuction() right after when the borrower borrows, and the buyer can buyLoan() right after, make borrower can't repay() the debt
function startAuction(uint256[] calldata loanIds) public {
for (uint256 i = 0; i < loanIds.length; i++) {
uint256 loanId = loanIds[i];
// get the loan info
Loan memory loan = loans[loanId];
// validate the loan
if (msg.sender != loan.lender) revert Unauthorized();
if (loan.auctionStartTimestamp != type(uint256).max)
revert AuctionStarted();
// set the auction start timestamp
loans[loanId].auctionStartTimestamp = block.timestamp;
emit AuctionStart(
loan.borrower,
loan.lender,
loanId,
loan.debt,
loan.collateral,
block.timestamp,
loan.auctionLength
);
}
}
Impact
User can't takeback collateral token
Tools Used
Manual Review
Recommendations
Should have use the params Loan.auctionStartTimestamp is block.timestamp + REPAY_DEADLINE at the initial
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.