Submission Details
Severity:
burnKittyCoin() in KittyPool.sol should check if _hasEnoughMeowllateral()
Summary
A user with a bad debt can burn kittyCoin to avoid future liquidation because of a lack of debt check.
https://github.com/Cyfrin/2024-08-kitty-fi/blob/main/src/KittyPool.sol#L112
Vulnerability Details
The function burnKittyCoin() in KittyPool.sol doesn't consider the user's debt state. It doesn't check if msg.sender has a bad debt or not / can or cannot be liquidated, before autorizing to burn kittyCoin.
function burnKittyCoin(address _onBehalfOf, uint256 _ameownt) external {
kittyCoinMeownted[_onBehalfOf] -= _ameownt;
i_kittyCoin.burn(msg.sender, _ameownt);
}
Should add :
require(_hasEnoughMeowllateral(msg.sender), KittyPool__NotEnoughMeowllateralPurrrr());
before burning kittyCoin.
Impact
Stablecoin not being properly collateralized.
Recommendations
Replace the burnKittyCoin() code with :
function burnKittyCoin(address _onBehalfOf, uint256 _ameownt) external {
require(_hasEnoughMeowllateral(msg.sender), KittyPool__NotEnoughMeowllateralPurrrr());
kittyCoinMeownted[_onBehalfOf] -= _ameownt;
i_kittyCoin.burn(msg.sender, _ameownt);
}
Rewards breakdown
nSLOC
224This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.