Submission Details
Severity:
Borrower can DoS lender's auction.
Summary
A borrower can DoS their lender's auction.
Vulnerability Details
A lender could be auctioning a loan. Upon someone attempting to buy the loan, the borrower can just call refinance with the same borrow parameters to simply refresh the loan's auctionStartTimestamp.
loans[loanId].startTimestamp = block.timestamp;
// update loan auction start timestamp
loans[loanId].auctionStartTimestamp = type(uint256).max;
Now that the value of auctionStartTimestamp is refreshed, the call to buyLoan will revert due to this line of code:
if (loan.auctionStartTimestamp == type(uint256).max)
revert AuctionNotStarted();
Impact
Borrower can DoS their lender's auction.
Tools Used
Manual review
Recommendations
If a refinance happens to the same pool, do not refresh the value of auctionStartTimestamp
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.