15,000 USDC
Submission Details
Severity:
`MErc20DelegateFixer::repayBadDebtWithCash` the function doesn't check amount input.
Summary
MErc20DelegateFixer::repayBadDebtWithCash since there is no input validation for the amount argument, an unsatisfactory value can be passed in.
Vulnerability Details
As seen below, there is no input validation check for the amount. As such, the function can be called with zero amount.
function repayBadDebtWithCash(uint256 amount) external nonReentrant {
/// Checks and Effects
badDebt = SafeMath.sub(badDebt, amount, "amount exceeds bad debt");
EIP20Interface token = EIP20Interface(underlying);
/// Interactions
require(
token.transferFrom(msg.sender, address(this), amount),
"transfer in failed"
);
emit BadDebtRepayed(amount);
}
Impact
users can pay zero bad debt
Tools Used
Manual
Recommendations
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
39438 USDC / LOC
14,000 USDC
1,000 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.