Moonwell

Summary

Since the MErc20DelegateFixer.fixUser function bypasses the MToken.transferTokens function the liquidator's rewardSupplierIndex is not updated. So the rewards calculation will count the new mToken balance of the liquidator for the whole period since the previous reward distribution. Anyone can call The Comptroller.claimReward function for any user. This way the wrong amount of rewards will be distributed to the liquidator balance (multisig) besides of the wish of DAO.

Vulnerability Details

MErc20DelegateFixer.fixUser function transfers mTokens from liquidated account to the liquidator's address:

The common flow for all transfers includes call to the Comptroller contract to check transfer allowance and to distribute rewards for previous period:

https://github.com/Cyfrin/2024-03-Moonwell/blob/e57b8551a92824d35d4490f5e7f27c373be172bd/src/Comptroller.sol#L601-L617

There are no liquidator's rewards claim in the MErc20DelegateFixer.fixUser and in the mipm17 proposal. So after the proposal execution the liquidator can receive additional reward tokens because of the incorrect period. This can cause different issues such as an unexpected voting power of the liquidator account (multisig).

Impact

Incorrect rewards distribution, unexpected behavior.

Tools used

Manual Review

Recommendations

Consider calling the Comptroller.claimReward function for the liquidator account before mToken transfer.