M-01: Invalid implementation following natspec
Summary
Vulnerability Details
The _repayinternal function of LendingPool.solspecifies "If onBehalfOf is set to address(0), the function defaults to repaying the caller's own debt." This can lead to broken functionality with bad assumptions about the contract
Impact
The _repayinternal function of LendingPool.solwhich creates the following issues when used otherwise
Misrepresented assumption of fallback logic which in this case none of that exists
Protocol Integrations Break – External integrations relying on explicit
onBehalfOfassignments might behave unpredictably, resulting in incorrect debt accounting.
Tools Used
Manual Review
Recommendations
Remove the
if (onBehalfOf == address(0)) revert AddressCannotBeZero();to comply with the natspecAdd the fallback handling of zero address in
_repayfunction that takes themsg.senderinto consideration
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.