0x73696d616f - Liquidator will leave a pool with unassigned earnings on Market::clearBadDebt()
free to claim for anyone when the repaid maturity is not the last
#73
Labels
Medium
A Medium severity issue.
Reward
A payout will be made for this issue
Sponsor Confirmed
The sponsor acknowledged this issue is valid
Will Fix
The sponsor confirmed this issue will be fixed
0x73696d616f
Medium
Liquidator will leave a pool with unassigned earnings on
Market::clearBadDebt()
free to claim for anyone when the repaid maturity is not the lastSummary
This issue remains from the last audit, only a partial fix was applied.
The issue is that in
Market::clearBadDebt()
, when a maturity is repaid, the unassigned earnings of this pool only go to the earnings accumulator when the last maturity is liquidated. However, if it's not the last maturity, the problem remains in case there is another borrowed maturity, and some user can claim these unassigned earnings just by supplying a few funds. Or if allfloatingBackupBorrowed
was due to the repaid maturity, and now it is 0, so users can borrow and deposit 1 wei to steal the unassigned earnings.Root Cause
In
Market:661
, theearningsAccumulator is only increased [when](https://github.com/sherlock-audit/2024-07-exactly-stacking-contracts/blob/main/protocol/contracts/Market.sol#L652-L655)
fixedPools[maturity].borrowed == position.principal.
position.principalis always 0, as
fixedBorrowPositions[maturity][borrower]has been deleted. Thus it will only assign the unassigned earnings when
fixedPools[maturity].borrowed` becomes null after a repayment. This means that as long as there are other borrowed maturities, the unassigned earnings may be stolen.Internal pre-conditions
External pre-conditions
None.
Attack Path
Market
viaMarket::deposit()
for the maturities to borrow, increasingfloatingBackupBorrow
and generating unassigned earnings.fixedPools[maturity].borrowed
is not null.earningsAccumulator
.Impact
Attacker can claim a lot of unassigned earnings just by depositing at maturity enough (may be as small as 1 wei) to cover remaining
floatingBackupBorrowed
.PoC
Add the following POC to
Market.t.sol
, showing how a depositMaturity of 10 wei is enough to steal all unassigned maturities.Mitigation
The unassigned earnings should be assigned to the earnings accumulator pro-rata to the
floatingBackupBorrowed
cleared in the bad debt clearance.The text was updated successfully, but these errors were encountered: