Moonwell
Moonwell
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Protocol may not work well with pausable or transfer blocking tokens

aballok

Summary

If the relevant underlying tokens are pausable or allow transfers blocking causing transfers to fail

Vulnerability Details

Consider relevant tokens WBTC, USDT,USDC with pausable and transfer blocking capabilities

  • blocklisting, blacklisting, pausing maybe even block the Moonwell and Moonwell related contract addresses

function repayBadDebtWithCash(uint256 amount) external nonReentrant {
/// Checks and Effects
badDebt = SafeMath.sub(badDebt, amount, "amount exceeds bad debt");
​
EIP20Interface token = EIP20Interface(underlying);
​
/// Interactions
require(
token.transferFrom(msg.sender, address(this), amount),
"transfer in failed"
);
​
emit BadDebtRepayed(amount);
}

Impact

Transfers will always fail, revert, sweeps cant be made, token transfers cant be made

Tools Used

Manual Analysis

Recommendations

Recommended to monitor for pausing, stopping fo transfers for certain addresses etc. Recommended proposal move fast before such. Recommended in future maybe whitelist allowed tokens avoid such tokens

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.