reNFT - albertwh1te's results

Lines of code

https://github.com/re-nft/smart-contracts/blob/3ddd32455a849c3c6dc3c3aad7a33a6c9b44c291/src/modules/PaymentEscrow.sol#L190-L202 https://github.com/re-nft/smart-contracts/blob/3ddd32455a849c3c6dc3c3aad7a33a6c9b44c291/src/policies/Stop.sol#L265-L306

Vulnerability details

Impact

When a borrower is blacklisted by USDC and the lender sets ERC20 as USDC, transferring USDC to the borrower becomes impossible, leading to a chain of reverts:

PaymentEscrow._settlePaymentInFull reverts
PaymentEscrow._settlePayment reverts
PaymentEscrow.settlePayment reverts
Stop.stopRent reverts

As a result, the borrower's PAY rentals can't be stopped, allowing them to keep the NFT indefinitely.

Proof of Concept

The implementation of USDC's transfer and transferFrom functions differs from other ERC20 contracts. It first checks if the account is on the blacklist.

    modifier notBlacklisted(address _account) {
        require(
            !blacklisted[_account],
            "Blacklistable: account is blacklisted"
        );
        _;
    }
    /**
     * @notice Transfer tokens from the caller
     * @param to    Payee's address
     * @param value Transfer amount
     * @return True if successful
     */
    function transfer(address to, uint256 value)
        external
        override
        whenNotPaused
        notBlacklisted(msg.sender)
        notBlacklisted(to)
        returns (bool)
    {
        _transfer(msg.sender, to, value);
        return true;
    }

    /**
     * @notice Transfer tokens by spending allowance
     * @param from  Payer's address
     * @param to    Payee's address
     * @param value Transfer amount
     * @return True if successful
     */
    function transferFrom(
        address from,
        address to,
        uint256 value
    )
        external
        override
        whenNotPaused
        notBlacklisted(msg.sender)
        notBlacklisted(from)
        notBlacklisted(to)
        returns (bool)
    {
        require(
            value <= allowed[from][msg.sender],
            "ERC20: transfer amount exceeds allowance"
        );
        _transfer(from, to, value);
        allowed[from][msg.sender] = allowed[from][msg.sender].sub(value);
        return true;
    }

1. The blacklisted borrower borrows an NFT
2. The rental process can't be halted due to fail of usdc transcations.

Tools Used

Foundry

Recommended Mitigation Steps

Allow users to claim their fees instead of sending them directly to the user's address.

Assessed type

ERC20