Moonwell - Jorgect's results

Lines of code

https://github.com/code-423n4/2023-07-moonwell/blob/fced18035107a345c31c9a9497d0da09105df4df/src/core/Comptroller.sol#L689

Vulnerability details

The comptroller contract is missing importan validation when the admin set a new close factor

Impact

Lack on validation when setting new close factor can let the contract in a position where liquidator can liquidate more than he should.

Proof of Concept

The comptroller contract is declaring in the top of the code the next staments:

// closeFactorMantissa must be strictly greater than this value
    uint256 internal constant closeFactorMinMantissa = 0.05e18; // 0.05

// closeFactorMantissa must not exceed this value
uint256 internal constant closeFactorMaxMantissa = 0.9e18; // 0.9

however when the admin set the close factor there is no validation of the new close factor:

file:src/core/Comptroller.sol
 function _setCloseFactor(uint newCloseFactorMantissa) external returns (uint) {
        // Check caller is admin
    	require(msg.sender == admin, "only admin can set close factor");

        uint oldCloseFactorMantissa = closeFactorMantissa;
        closeFactorMantissa = newCloseFactorMantissa;
        emit NewCloseFactor(oldCloseFactorMantissa, closeFactorMantissa);

        return uint(Error.NO_ERROR);
    }

https://github.com/code-423n4/2023-07-moonwell/blob/fced18035107a345c31c9a9497d0da09105df4df/src/core/Comptroller.sol#L689

Tools Used

manual

Recommended Mitigation Steps

check if the close factor is in the properly range:

function _setCloseFactor(uint newCloseFactorMantissa) external returns (uint) {
        // Check caller is admin
    	require(msg.sender == admin, "only admin can set close factor");

        require(newCloseFactorMantissa>=closeFactorMinMantissa);
        require(newCloseFactorMantissa<= closeFactorMaxMantissa);

        uint oldCloseFactorMantissa = closeFactorMantissa;
        closeFactorMantissa = newCloseFactorMantissa;
        emit NewCloseFactor(oldCloseFactorMantissa, closeFactorMantissa);

        return uint(Error.NO_ERROR);
    }

Assessed type

Other