Ethereum Credit Guild - The-Seraphs's results

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/main/src/loan/LendingTerm.sol#L323-L330

Vulnerability details

Description

In LendingTerm::debtCeiling() function, it intends to return the minimum of creditMinterBuffer, hardCap, and debtCeiling.

function debtCeiling(
    int256 gaugeWeightDelta
) public view returns (uint256) {
    ...
    ...
    // return min(creditMinterBuffer, hardCap, debtCeiling)
    if (creditMinterBuffer < _debtCeiling) {
        return creditMinterBuffer;
    }
    if (_hardCap < _debtCeiling) {
        return _hardCap;
    }
    return _debtCeiling;
}

But the above implementation of min using the if condition is incorrect, as it doesn't return the minimum of the three values.

Impact

The function LendingTerm::debtCeiling() has the following documentation:

/// @notice returns the maximum amount of debt that can be issued by this term
/// according to the current gauge allocations.

The function intends to return the maximum amount of debt that the term can issue. Because of the incorrect implementation of the if statment for the min, the function can return higher debt than the maximum allowed by the term.

The function LendingTerm::debtCeiling() is also used in GuildToken::_decrementGaugeWeight() which has the following require statement:

...
...
uint256 debtCeilingAfterDecrement = LendingTerm(gauge).debtCeiling(-int256(weight));
require(
    issuance <= debtCeilingAfterDecrement,
    "GuildToken: debt ceiling used"
);
...
...

The above check might pass if the returned debtCeiling is higher than the actual value.

Proof of concept

Textual representation of the if statements

1. Check if creditMinterBuffer is less than _debtCeiling:

   • If true, return creditMinterBuffer.
   • If false, proceed to the next condition.

2. Check if _hardCap is less than _debtCeiling:

   • If true, return _hardCap.
   • If false, proceed to the default case.

3. Return _debtCeiling (default case).

Now, assume the following hypothetical values:

creditMinterBuffer = 200;
_debtCeiling = 300;
_hardCap = 100;

In this case the first if condition will succeed, and creditMinterBuffer = 200 will be returned, even though the minimum value that should be returned is _hardCap = 100

...
...
if (creditMinterBuffer < _debtCeiling) {
    return creditMinterBuffer;
}
...
...

Tools Used

Manual review

Recommended Mitigation Steps

...
...
+ import {Math} from "@openzeppelin/contracts/utils/math/Math.sol";
...
...

contract LendingTerm is CoreRef {
    ...
    ...
    function debtCeiling(
        int256 gaugeWeightDelta
    ) public view returns (uint256) {
        ...
        ...
+       return Math.min(Math.min(creditMinterBuffer, _debtCeiling), _hardCap);
-       if (creditMinterBuffer < _debtCeiling) {
-           return creditMinterBuffer;
-       }
-       if (_hardCap < _debtCeiling) {
-           return _hardCap;
-       }
-       return _debtCeiling;
    }
    ...
    ...
}

Assessed type

Math