Illuminate contest - auditor0517's results

Lines of code

https://github.com/code-423n4/2022-06-illuminate/blob/92cbb0724e594ce025d6b6ed050d3548a38c264b/redeemer/Redeemer.sol#L187

Vulnerability details

Impact

Redeemer.redeem() for Element withdraws PT to wrong address. This might cause a result of loss of PT.

Proof of Concept

According to the ReadMe.md, Redeemer should transfer external principal tokens from Lender.sol to Redeemer.sol. But it transfers to the "marketPlace" and it would lose the PT.

Tools Used

Manual Review

Recommended Mitigation Steps

Modify IElementToken(principal).withdrawPrincipal(amount, marketPlace); like this.

IElementToken(principal).withdrawPrincipal(amount, address(this));

Lines of code

https://github.com/code-423n4/2022-06-illuminate/blob/92cbb0724e594ce025d6b6ed050d3548a38c264b/lender/Lender.sol#L247-L299 https://github.com/code-423n4/2022-06-illuminate/blob/92cbb0724e594ce025d6b6ed050d3548a38c264b/lender/Lender.sol#L311-L358

Vulnerability details

Impact

Some Lender.lend() functions don't update senders' balance after swap. The senders can't redeem later because their balance isn't updated.

Proof of Concept

The amount of PT should be added to the senders' balance using mint function.

Tools Used

Manual Review

Recommended Mitigation Steps

• Modify yield(u, y, returned, address(this)); like this.

uint256 ptAmount = yield(u, y, returned, address(this));
address illuminateToken = principalToken(u, m);
IERC5095(illuminateToken).mint(msg.sender, ptAmount);

• Add below uint256 purchased = IElement(e).swap(swap, fund, r, d);.

address illuminateToken = principalToken(u, m);
IERC5095(illuminateToken).mint(msg.sender, purchased);

Lines of code

https://github.com/code-423n4/2022-06-illuminate/blob/92cbb0724e594ce025d6b6ed050d3548a38c264b/redeemer/Redeemer.sol#L128

Vulnerability details

Impact

Redeemer.redeem() for Illuminate doesn't send the asset to the user. The user might lose his underlying asset.

Proof of Concept

This function should transfer the asset to the user but it transfers to the contract.

Tools Used

Manual Review

Recommended Mitigation Steps

Modify Safe.transferFrom(IERC20(u), lender, address(this), amount); like this.

Safe.transferFrom(IERC20(u), lender, msg.sender, amount);