Venus Prime - Aymen0909's results

Lines of code

https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/Prime.sol#L174-L194 https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/Prime.sol#L930-L936

Vulnerability details

Impact

The getPendingInterests function is using IVToken(market).underlying() to get the underlying token address returned but this will not handle the case of VBNB/WBNB as it is done _getUnderlying which will result in the wrong underlying token being returned when dealing with VBNB market which will be misleading to users and parties relying on the returned values in their respective protocols

Proof of Concept

The issue occurs in the getPendingInterests function below :

function getPendingInterests(address user) external returns (PendingInterest[] memory pendingInterests) {
    address[] storage _allMarkets = allMarkets;
    PendingInterest[] memory pendingInterests = new PendingInterest[](_allMarkets.length);

    for (uint256 i = 0; i < _allMarkets.length; ) {
        address market = _allMarkets[i];
        uint256 interestAccrued = getInterestAccrued(market, user);
        uint256 accrued = interests[market][user].accrued;

        pendingInterests[i] = PendingInterest({
            //@audit should use _getUnderlying(market) to handle VBNB/WBNB
            market: IVToken(market).underlying(),
            amount: interestAccrued + accrued
        });

        unchecked {
            i++;
        }
    }

    return pendingInterests;
}

As you can see the call directly IVToken(market).underlying() to the market underlying token address but this will not work with the VBNB market, as it's handled differently in the _getUnderlying function below :

function _getUnderlying(address vToken) internal view returns (address) {
    //@audit `VBNB/WBNB` is a special market
    if (vToken == VBNB) {
        return WBNB;
    } else {
        return IVToken(vToken).underlying();
    }
}

Thus the getPendingInterests function could return a wrong address (or zero address) when dealing with VBNB/WBNB market, this can cause problems for users or other protocols relying on the returned data (token address & accrued rewards) in their logic.

Tools Used

Manual review

Recommended Mitigation Steps

To avoid this issue you should use _getUnderlying function to get underlying token address in getPendingInterests.

Assessed type

Context