Moonwell

Summary

The repayBadDebtWithCash function in the MErc20DelegateFixer contract does not include a verification step to check the balance after the transfer of tokens. This omission may result in a lack of assurance that the transfer was executed as expected, potentially leading to unexpected behavior or vulnerabilities.

Vulnerability Details

The repayBadDebtWithCash function relies on the transferFrom call to withdraw funds from the user's account. However, it lacks a subsequent check to ensure the intended amount was successfully transferred. This can lead to unexpected behavior in the following scenarios:

• Insufficient User Balance: If the user has insufficient funds to cover the amount requested, the transferFrom call might revert. However, the repayBadDebtWithCash function wouldn't detect this failure and would continue execution, potentially leading to inconsistencies in the bad debt counter and user balances.

• External Contract Issues: In rare cases, the transferFrom call might fail due to external contract issues beyond the control of this contract. Without a balance check, the function wouldn't be aware of the failure and might proceed with state updates based on an incorrect assumption of successful transfer.

Impact

A missing balance check can have the following consequences:

• Inaccurate Bad Debt Reduction: The bad debt counter might be incorrectly decremented even if the user transfer fails, leading to discrepancies in accounting.

• Unintended User Penalty: If the bad debt counter isn't updated correctly, users might be penalized for a failed transfer attempt.

• Unexpected Contract Behavior: The contract might enter an inconsistent state due to mismatched balance assumptions, potentially impacting other functionalities.

Tools Used

Manual review

Recommendations

To address this vulnerability, it's recommended to add a balance check after the transferFrom call. Here's how:

We should always be careful and take extra precautions like checking before and after balances in order to protect the protocol from attacks