Submission Details
Severity:
Lender.sol - use pull for feeReceiver
Summary
borrow() calls could be blocked if feeReceiver cannot receive the fees.
Vulnerability Details
It's important to ensure that the contract functionality cannot be blocked by external entities.
Impact
The contract won't work as expected
Tools Used
Manual Review
Recommendations
Accumulate the fees in the contract and force feeReceiver to call a new function getFees() to transfer the balance.
mapping(address feeTokenAddress => uint256 feeBalance) public acumulatedFees;
event FeesTrannsferred(address indexed feeToken, uint256 amount);
function getFees(address _feeTokenAddress) external onlyFeeReceiver {
uint256 balance = acumulatedFees[_feeTokenAddress];
IERC20(_feeTokenAddress).safeTransfer(feeReceiver, balance);
acumulatedFees[_feeTokenAddress] -= amount;
emit FeesTrannsferred(_feeTokenAddress, amount);
}
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.