15,000 USDC
Submission Details
Severity:
Missing Validation on Bad Debt When `MOONWELL_mxcDOT`
Summary
In mip-m17.sol, the validation for MOONWELL_mxcDOT misses checking the bad debt which should not be 0.
Vulnerability Details
Similar to MOONWELL_mFRAX, the bad debt in MOONWELL_mxcDOT should not be 0 since it is intended to record the actual bad debt in fixUser.
Impact
This is more like an Inconsistency issue and a better-have issue to ensure the fixUser operation for MOONWELL_mxcDOT is processed.
Tools Used
Manual
Recommendations
Similar validation should be added for MOONWELL_mxcDOT, to avoid unexpected fix result:
assertTrue(
mErc20Delegator.badDebt() != 0,
"mxcDOT bad debt should not start at 0"
);
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
39438 USDC / LOC
14,000 USDC
1,000 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.