The repayBadDebtWithCash
function in the MErc20DelegateFixer
contract does not include a verification step to check the balance after the transfer of tokens. This omission may result in a lack of assurance that the transfer was executed as expected, potentially leading to unexpected behavior or vulnerabilities.
The repayBadDebtWithCash
function relies on the transferFrom
call to withdraw funds from the user's account. However, it lacks a subsequent check to ensure the intended amount was successfully transferred. This can lead to unexpected behavior in the following scenarios:
Insufficient User Balance: If the user has insufficient funds to cover the amount
requested, the transferFrom
call might revert. However, the repayBadDebtWithCash
function wouldn't detect this failure and would continue execution, potentially leading to inconsistencies in the bad debt counter and user balances.
External Contract Issues: In rare cases, the transferFrom
call might fail due to external contract issues beyond the control of this contract. Without a balance check, the function wouldn't be aware of the failure and might proceed with state updates based on an incorrect assumption of successful transfer.
A missing balance check can have the following consequences:
Inaccurate Bad Debt Reduction: The bad debt counter might be incorrectly decremented even if the user transfer fails, leading to discrepancies in accounting.
Unintended User Penalty: If the bad debt counter isn't updated correctly, users might be penalized for a failed transfer attempt.
Unexpected Contract Behavior: The contract might enter an inconsistent state due to mismatched balance assumptions, potentially impacting other functionalities.
Manual review
To address this vulnerability, it's recommended to add a balance check after the transferFrom
call. Here's how:
We should always be careful and take extra precautions like checking before and after balances in order to protect the protocol from attacks
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.