Inverse Finance contest - Picodes's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/DBR.sol#L325

Vulnerability details

Impact

forceReplenish could be frontran to avoid paying interests, so a malicious user could avoid paying any interest by "transferring" its position to a clean address.

Proof of Concept

Imagine the following scenario:

• Alice borrows X DOLA and has no DBR
• Whenever someone tries to call forceReplenish or whenever she thinks it would be profitable to do so, with a clean address ad in a single transaction Alice
  • flashloans X DOLA
  • calls repay and withdrawOnBehalf to clean the position of her first address
  • opens a new vault identical to the first one
  • repays the flashloan with the borrowed DOLA

At this point Alice has a balance of DBR of 0 with her new address, and she don't care about the previous one as there is no collateral in it anymore. So she avoided paying interests for this period.

Disclaimer: this could not be profitable for Alice depending on the rewards and the frequency of forceReplenish calls. But at least this should lead to a loss of funds for the protocol and keepers.

Recommended Mitigation Steps

Check when withdrawing that the user does not have a negative DBR balance