Submission Details
Severity:
There is no checking if loan's loanRatio is greater than pool's maxLoanRatio in buyLoan() function
Summary
There is no checking if loan's loanRatio is greater than pool's maxLoanRatio in buyLoan() function
Vulnerability Details
There is no checking if loan's loanRatio is greater than pool's maxLoanRatio in buyLoan() function
Impact
Because there is no checking if loan's loanRatio is greater than pool's maxLoanRatio in buyLoan() function, user can buy very risk loan with very high loanRatio.
Tools Used
Manual
Recommendations
Need to revert if loan's loanRatio is greater than pool's maxLoanRatio in buyLoan() function.
function buyLoan(uint256 loanId, bytes32 poolId) public {
// get the loan info
...
// reject if the pool is not big enough
uint256 totalDebt = loan.debt + lenderInterest + protocolInterest;
if (pools[poolId].poolBalance < totalDebt) revert PoolTooSmall();
uint256 loanRatio = (totalDebt * 10 ** 18) / loan.collateral;
if (loanRatio > pools[poolId].maxLoanRatio) revert RatioTooHigh();
...
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.