Submission Details
Severity:
Incorrect loans update
Summary
In Lender.sol,the buyLoan function does not correctly update Loans array.
function buyLoan(uint256 loanId, bytes32 poolId) public {
//..
// update the loan with the new info
loans[loanId].lender = msg.sender; //@audit pool.lender ?
loans[loanId].interestRate = pools[poolId].interestRate;
loans[loanId].startTimestamp = block.timestamp;
loans[loanId].auctionStartTimestamp = type(uint256).max;
loans[loanId].debt = totalDebt;
//..
}
Vulnerability Details
The loans[loanId].lender is updated with msg.sender instead of pool.lender
Impact
The new lender will earn free interest and be able to withdraw from the pool.
Tools Used
Manual review
Recommendations
use
loans[loanId].lender = pool.lender
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.