veRWA - T1MOH's results

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/9a2e7be003bc1a77b3b87db31f3d5a1bcb48ed32/src/LendingLedger.sol#L131 https://github.com/code-423n4/2023-08-verwa/blob/9a2e7be003bc1a77b3b87db31f3d5a1bcb48ed32/src/LendingLedger.sol#L204-L207

Vulnerability details

Impact

Internal balances of market and lender per epoch are updated when market calls sync_ledger() on deposit or withdrawal. However they won't be updated if market is removed from whitelist. In case governance whitelists this market again, internal balances will not correspond to actual balances on market because data update was disallowed. As a result, data will corrupt if the market is re-added to the whitelist.

Proof of Concept

sync_ledger() doesn't perform internal updates when market is not whitelisted.

    function sync_ledger(address _lender, int256 _delta) external {
        address lendingMarket = msg.sender;
        require(lendingMarketWhitelist[lendingMarket], "Market not whitelisted");

        ...
    }

Deposits and withdrawal will still be processed on market, but here is not updated. And if governance returns back this market to whitelist, all accounting will be corrupted, balances in LendingLedger won't reflect actual balances on market.

Tools Used

Manual review

Recommended Mitigation Steps

Explicitly disallow removing markets from whitelist

Assessed type

Other