Canto v2 contest - Critical's results

Lines of code

https://github.com/Plex-Engineer/lending-market-v2/blob/main/contracts/Accountant/AccountantDelegate.sol#L75-L102

Vulnerability details

function sweepInterest() external override {
    if (msg.sender != admin ) {
        revert SenderNotAdmin(msg.sender);
    }
    //Total balance of Treasury => Note + CNote Balance, 
    Exp memory exRate = Exp({mantissa: cnote.exchangeRateStored()}); //used stored interest rates in determining amount to sweep
    
    //underflow impossible
    uint noteDiff = sub_(note.totalSupply(), note.balanceOf(address(this))); //Note deficit in Accountant
    uint cNoteBal = cnote.balanceOf(address(this)); //current cNote Balance
    uint cNoteAmt = mul_(cNoteBal, exRate); // cNote Balance converted to Note

    require(cNoteAmt >= noteDiff, "AccountantDelegate::sweepInterest:Error calculating interest to sweep");

    uint amtToSweep = sub_(cNoteAmt, noteDiff); // amount to sweep in Note, 
    uint cNoteToSweep = div_(amtToSweep, exRate); // amount of cNote to sweep = amtToSweep(Note) / exRate

    cNoteToSweep = (cNoteToSweep > cNoteBal) ? cNoteBal :  cNoteToSweep; 
    bool success = cnote.transfer(treasury, amtToSweep);
    if (!success) {
        revert  SweepError(treasury , amtToSweep); //handles if transfer of tokens is not successful
    }

    TreasuryInterface Treas = TreasuryInterface(treasury);
    Treas.redeem(address(cnote),amtToSweep);

    require(cnote.balanceOf(treasury) == 0, "AccountantDelegate::sweepInterestError");
}

L101 will revert when there is more than 0 of cNote in treasury's balance.

The attacker can send 1 wei of cnote to treasury and sweepInterest() will malfunction.

Recommended Mitigation Steps

Remove L101.

Lines of code

https://github.com/Plex-Engineer/lending-market-v2/blob/main/contracts/Accountant/AccountantDelegate.sol#L75-L102

Vulnerability details

function sweepInterest() external override {
    if (msg.sender != admin ) {
        revert SenderNotAdmin(msg.sender);
    }
    //Total balance of Treasury => Note + CNote Balance, 
    Exp memory exRate = Exp({mantissa: cnote.exchangeRateStored()}); //used stored interest rates in determining amount to sweep
    
    //underflow impossible
    uint noteDiff = sub_(note.totalSupply(), note.balanceOf(address(this))); //Note deficit in Accountant
    uint cNoteBal = cnote.balanceOf(address(this)); //current cNote Balance
    uint cNoteAmt = mul_(cNoteBal, exRate); // cNote Balance converted to Note

    require(cNoteAmt >= noteDiff, "AccountantDelegate::sweepInterest:Error calculating interest to sweep");

    uint amtToSweep = sub_(cNoteAmt, noteDiff); // amount to sweep in Note, 
    uint cNoteToSweep = div_(amtToSweep, exRate); // amount of cNote to sweep = amtToSweep(Note) / exRate

    cNoteToSweep = (cNoteToSweep > cNoteBal) ? cNoteBal :  cNoteToSweep; 
    bool success = cnote.transfer(treasury, amtToSweep);
    if (!success) {
        revert  SweepError(treasury , amtToSweep); //handles if transfer of tokens is not successful
    }

    TreasuryInterface Treas = TreasuryInterface(treasury);
    Treas.redeem(address(cnote),amtToSweep);

    require(cnote.balanceOf(treasury) == 0, "AccountantDelegate::sweepInterestError");
}

In the context, cNoteToSweep represents the interest earnings in cNote.

However, the cNoteToSweep is not used when transferring cNote to the treasury at L93, instead, amtToSweep is used.

As a result, when exRate > 1, more cNote than expected will be transferred to the treasury, and this will lead to a shortage of cNote for the accountant, further leading to AccountantSupplyError when repayBorrow in cNote.

Proof of Concept

1. Alice borrowed 1,000,000e18 note
2. Bob borrowed 1,000,000e18 note
3. Some time later, due to the accumulation of interest, exRate = 1.1e18
4. Admin called sweepInterest():

• noteDiff = 2,000,000e18
• cNoteAmt = 2,200,000e18
• amtToSweep = 200,000e18
• cNoteToSweep = ~181,818e18 (181818181818181818181818)
• cNoteBal.balanceOf(accountant) = 2,000,000e18 - 200,000e18 = 1,800,000e18

4. Alice called repayBorrow() to repay 1,100,000e18 note:

• accountant.redeemMarket(1,100,000e18)
• cNoteBal.balanceOf(accountant) = 1,800,000e18 - 1,000,000e18 = 700,000e18

5. Bob called repayBorrow() to repay 1,100,000e18 note, the transaction will revert with AccountantSupplyError, Bob was forced to continue paying interests.

Recommended Mitigation Steps

Change from amtToSweep to cNoteToSweep in L93