Inverse Finance contest - Ch_301's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L566

Vulnerability details

Impact

Users abels to invoke forceReplenish() when they are on liquidation position

Proof of Concept

On Market.sol ==> forceReplenish() On this line

uint collateralValue = getCollateralValueInternal(user);

getCollateralValueInternal(user) only return the value of the collateral

    function getCollateralValueInternal(address user) internal returns (uint) {
        IEscrow escrow = predictEscrow(user);
        uint collateralBalance = escrow.balance();
        return collateralBalance * oracle.getPrice(address(collateral), collateralFactorBps) / 1 ether; 

So if the user have 1.5 wETH at the price of 1 ETH = 1600 USD It will return 1.5 * 1600 and this value is the real value we can’t just check it directly with the debt like this

 require(collateralValue >= debts[user], "Exceeded collateral value");

This is no longer over collateralized protocol The value needs to be multiplied by collateralFactorBps / 10000

• So depending on the value of collateralFactorBps and liquidationFactorBps the user could be in the liquidation position but he is able to invoke forceReplenish() to cover all their dueTokensAccrued[user] on DBR.sol and get more DOLA
• or it will lead a healthy debt to be in the liquidation position after invoking forceReplenish()

Recommended Mitigation Steps

Use getCreditLimitInternal() rather than getCollateralValueInternal().

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/main/src/DBR.sol#L313-L317 https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L531-L539

Vulnerability details

Impact

The users could repay() their debt of DOLA without having any amount of DBR on their balance

Proof of Concept

When user repays his debt. he needs to pay DBR as an interest which is tracked on dueTokensAccrued[user] Let’s say Alice has a 300 DOLA debt. After T amount of time he invokes repay() on Market.sol

function repay(address user, uint amount) public {
        uint debt = debts[user];
        require(debt >= amount, "Insufficient debt");
        debts[user] -= amount;
        totalDebt -= amount;
        dbr.onRepay(user, amount);
        dola.transferFrom(msg.sender, address(this), amount);
        emit Repay(user, msg.sender, amount);
    }

This line

dbr.onRepay(user, amount);

Will execute on DBR.sol

function onRepay(address user, uint repaidDebt) public {
        require(markets[msg.sender], "Only markets can call onRepay");
        accrueDueTokens(user);
        debts[user] -= repaidDebt;
    }

And on

  accrueDueTokens(user)

Just calculate the interest But there is no check if the user is actually has this amount of DBR

Recommended Mitigation Steps

In case repay all the debts, you need to check if the user has a deficit. Here you can revert repay()or invoke onForceReplenish() or accept the repay with liquidate() some collateral to pay the deficit