The Wildcat Protocol - audityourcontracts's results

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarket.sol#L142

Vulnerability details

Impact

The ability for a market to be closed by a borrower is important functionality for the Wildcat protocol. It ceases the ability for Lenders to lend and Borrowers to borrow and stops interest being accrued for the borrower to pay. The borrower can repay lenders through direct transfers to the market for Lenders to withdraw however this doesn't set the APR to 0 or close the market to deposits and borrow.

Proof of Concept

closeMarket() is augmented by the onlyController access modifier which restricts the addresses that can call the function. onlyController is restricted to only be called by the Market Controller.

  function closeMarket() external onlyController nonReentrant { 
    MarketState memory state = _getUpdatedState();
    state.annualInterestBips = 0;
    state.isClosed = true;
    state.reserveRatioBips = 0;
    if (_withdrawalData.unpaidBatches.length() > 0) {
      revert CloseMarketWithUnpaidWithdrawals();
    }
    uint256 currentlyHeld = totalAssets();
    uint256 totalDebts = state.totalDebts();
    if (currentlyHeld < totalDebts) {
      // Transfer remaining debts from borrower
      asset.safeTransferFrom(borrower, address(this), totalDebts - currentlyHeld);
    } else if (currentlyHeld > totalDebts) {
      // Transfer excess assets to borrower
      asset.safeTransfer(borrower, currentlyHeld - totalDebts);
    }
    _writeState(state);
    emit MarketClosed(block.timestamp);
  }

The issue is the Market Controller has no functionality to call closeMarket() and the borrower, if they try to call it, will revert. Therefore markets cannot be closed.

Tools Used

Vim

Recommended Mitigation Steps

If we follow the same pattern as a functionality like updateAccountAuthorization() closeMarket() should have a function in WildcatMarketController.sol that can only be called by the Borrower. Calling this new function in WildcatMarketController.sol would then call closeMarket() in WildcatMarket.sol as the controller. This would pass the access modifier and allow this markets to be closed.

Assessed type

Access Control