Astaria contest - 7siech's results

Lines of code

https://github.com/code-423n4/2023-01-astaria/blob/main/src/VaultImplementation.sol#L287

Vulnerability details

Impact

Once a borrower has committed to a loan, any subsequent loans made through VaultImplementation.commitToLien directly can specify any address as the receiver.

One potential threat vector is a public vault can try to motivate existing borrowers to take out a new loan with very attractive terms and make them sign a transaction interacting with the PublicVault directly.

To make the receiver more opaque, the malicious strategist can specify the vault address as the receiver. In the previous epoch, the colluding LP can request to withdraw their capital and can thus drain the vault of the loan issued to the vault itself.

The result is that the borrower will not receive the loan amount, but is still responsible for paying it back potentially resulting in liquidation of their collateral NFT.

Proof of Concept

Forge test -

https://gist.github.com/simonpure/a5305a0d9436ddf5a7cad2fff01f69ee#file-vaultexploit-t-sol

Logs - https://gist.github.com/simonpure/a5305a0d9436ddf5a7cad2fff01f69ee#file-log-txt

Tools Used

Forge

Recommended Mitigation Steps

• Limit committing to liens through AstariaRouter.commitToLiens link
• Make VaultImplementation.commitToLien a privileged call for the router only link