The Wildcat Protocol - KeyKiril's results

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/market/WildcatMarketWithdrawals.sol#L164-L170

Vulnerability details

Impact

The accountAddress, (address of the lender) is set instead of "borrowerAddress" when creating Escrow. Therefore a Lender is called instead of the borrower.

Proof of Concept

In the following code, the sentinel is creating a Escrow but the parameters set are wrong.

  if (IWildcatSanctionsSentinel(sentinel).isSanctioned(borrower, accountAddress)) {
      _blockAccount(state, accountAddress);
      address escrow = IWildcatSanctionsSentinel(sentinel).createEscrow(
        accountAddress,
        borrower,
        address(asset)
      );

The parameters are set as follows: accountAddress, borrower, address(asset).

But, in the function that we are calling "createEscrow" in the "WildcatSanctionsSentinel.sol" the parameters are set in a different order: address borrower, address account, address asset.

function createEscrow(
    address borrower,
    address account,
    address asset
  ) public override returns (address escrowContract) {
    if (!IWildcatArchController(archController).isRegisteredMarket(msg.sender)) {
      revert NotRegisteredMarket();
    }

Therefore, setting the Lender as a Borrower might lead to several issues. For example, the lender might be blocked but still eligible to call "releaseEscrow" and etc.

Tools Used

VS Code Manual Review

Recommended Mitigation Steps

Change the order of the parameters in the "executeWithdrawal" function as follows in the "createEscrow" function: address borrower, address account, address asset.

Assessed type

Error