DittoETH
Ditto
DeFiFoundryOracle
55,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect require in setter

alra

Summary

There are 3 setters in OwnerFacet.sol which require statement doesn't match with the error message.

Vulnerability Details

_setInitialMargin, _setPrimaryLiquidationCR and _setSecondaryLiquidationCR will revert for the value 100, which will revert with an incorrect error message, which is "below 1.0". When 100 is 1.0, not below.
*Instances (3)`

function _setInitialMargin(address asset, uint16 value) private {
require(value > 100, "below 1.0"); // @audit a value of 100 is 1x, so this should be > 101
s.asset[asset].initialMargin = value;
require(LibAsset.initialMargin(asset) < Constants.CRATIO_MAX, "above max CR");
}
​
function _setPrimaryLiquidationCR(address asset, uint16 value) private {
require(value > 100, "below 1.0"); // @audit a value of 100 is 1x, so this should be > 101
require(value <= 500, "above 5.0");
require(value < s.asset[asset].initialMargin, "above initial margin");
s.asset[asset].primaryLiquidationCR = value;
}
​
function _setSecondaryLiquidationCR(address asset, uint16 value) private {
require(value > 100, "below 1.0"); // @audit a value of 100 is 1x, so this should be > 101
require(value <= 500, "above 5.0");
require(value < s.asset[asset].primaryLiquidationCR, "above primary liquidation");
s.asset[asset].secondaryLiquidationCR = value;
}

As it is contrastable, in the below functions, this check is done correctly:

function _setForcedBidPriceBuffer(address asset, uint8 value) private {
require(value >= 100, "below 1.0");
require(value <= 200, "above 2.0");
s.asset[asset].forcedBidPriceBuffer = value;
}
​
function _setMinimumCR(address asset, uint8 value) private {
require(value >= 100, "below 1.0");
require(value <= 200, "above 2.0");
s.asset[asset].minimumCR = value;
require(
LibAsset.minimumCR(asset) < LibAsset.secondaryLiquidationCR(asset),
"above secondary liquidation"
);
}

Impact

The incorrect value for the require statement could lead to a restriction of precion for this parameters, it wouldn't be possible to input a net value of 100.

Tools Used

Manual review.

Recommendations

Value to which is checked the > operator should be 101, not 100.

Updates

Lead Judging Commences

0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-117

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.