Backed Protocol contest - AuditsAreUS's results

Lines of code

https://github.com/code-423n4/2022-04-backed/blob/e8015d7c4b295af131f017e646ba1b99c8f608f0/contracts/NFTLoanFacilitator.sol#L142-L162

Vulnerability details

Impact

There is on limit on the upper bounds on the amount a lender may send to a borrower. Borrowers will then be forced to pay interest and facilitators fee on the full amount loaned.

The impact for a borrower is that they may be forced to repay significantly more than desired if the lent amount is set to a high value. The borrower also is responsible for the originator fee too which is a percentage of the loan amount.

A borrower is not motivated to repay a loan if the amount is greater than the value of the collateral. Hence the borrow amount is essentially capped at the value of the NFT (excluding risk related to duration of the loan). This may be significantly higher than the borrower has desired, especially if the value of the NFT has increased dramatically.

Proof of Concept

lend() should only that amount >= loan.loanAmount (similarly for buyouts which has amount >= previousAmount), therefore lender may set the amount arbitrarily high and the borrower will be charged both facilitatorTake = amount * originationFeeRate / SCALAR and interest.

        if (loan.lastAccumulatedTimestamp == 0) {
            address loanAssetContractAddress = loan.loanAssetContractAddress;
            require(loanAssetContractAddress != address(0), "NFTLoanFacilitator: invalid loan");

            require(interestRate <= loan.perAnumInterestRate, 'NFTLoanFacilitator: rate too high');
            require(durationSeconds >= loan.durationSeconds, 'NFTLoanFacilitator: duration too low');
            require(amount >= loan.loanAmount, 'NFTLoanFacilitator: amount too low');
        
            loan.perAnumInterestRate = interestRate;
            loan.lastAccumulatedTimestamp = uint40(block.timestamp);
            loan.durationSeconds = durationSeconds;
            loan.loanAmount = amount;

            ERC20(loanAssetContractAddress).safeTransferFrom(msg.sender, address(this), amount);
            uint256 facilitatorTake = amount * originationFeeRate / SCALAR;
            ERC20(loanAssetContractAddress).safeTransfer(
                IERC721(borrowTicketContract).ownerOf(loanId),
                amount - facilitatorTake
            );
            IERC721Mintable(lendTicketContract).mint(sendLendTicketTo, loanId);
        } else {

Recommended Mitigation Steps

These costs may be avoided for a borrower by also allowing the borrower to set a maxAmount in createLoan() to which the amount lent cannot exceed this value.