Lybra Finance - caventa's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/configuration/LybraConfigurator.sol#L127 https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/configuration/LybraConfigurator.sol#L198-L205 https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/configuration/LybraConfigurator.sol#L331-L336 https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/configuration/LybraConfigurator.sol#L338-L341

Vulnerability details

Impact

Wrong if clause allows vaultBadCollateralRatio value that is larger than vaultSafeCollateralRatio value to be set

Proof of Concept

vaultBadCollateralRatio should always less than vaultSafeCollateralRatio

As shown in the code, vaultBadCollateralRatio = vaultSafeCollateralRatio - 10 (See LybraConfigurator.sol#L338-L341 and LybraConfigurator.sol#L198-L205)

However, badCollateralRatio is allowed to be reset with a wrong condition rule (See the following code => LybraConfigurator.sol#L126-L130)

    function setBadCollateralRatio(address pool, uint256 newRatio) external onlyRole(DAO) {
        require(newRatio >= 130 * 1e18 && newRatio <= 150 * 1e18 && newRatio <= vaultSafeCollateralRatio[pool] + 1e19, "LNA"); // @audit-info WRONG!
        vaultBadCollateralRatio[pool] = newRatio;
        emit SafeCollateralRatioChanged(pool, newRatio);
    }

where new badCollateralRatio can be larger than vaultSafeCollateralRatio by at most 10 (Which is wrong)

Tools Used

Manual

Recommended Mitigation Steps

Change LybraConfigurator#setBadCollateralRatio

    function setBadCollateralRatio(address pool, uint256 newRatio) external onlyRole(DAO) {
        --- require(newRatio >= 130 * 1e18 && newRatio <= 150 * 1e18 && newRatio <= vaultSafeCollateralRatio[pool] + 1e19, "LNA"); //@audit
        +++ require(newRatio >= 130 * 1e18 && newRatio <= 150 * 1e18 && newRatio <= vaultSafeCollateralRatio[pool] - 1e19, "LNA"); //@audit
        vaultBadCollateralRatio[pool] = newRatio;
        emit SafeCollateralRatioChanged(pool, newRatio);
    }

Assessed type

Invalid Validation