The Wildcat Protocol - crunch's results

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/market/WildcatMarket.sol#L142-L161

Vulnerability details

Impact

There is no way to close a market.

Proof of Concept

function closeMarket() is defined in contract WildcatMarket to close a market.

This function is only callable by market controller.

  function closeMarket() external onlyController nonReentrant {

Unfortunately, there is no code calls function closeMarket() in WildcatMarketController contract.

So there is no way to close a market.

Tools Used

Manual Review

Recommended Mitigation Steps

function closeMarket() should be callable by the borrower.

- function closeMarket() external onlyController nonReentrant {
+ function closeMarket() external onlyBorrower nonReentrant {

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/market/WildcatMarketConfig.sol#L74-L81

Vulnerability details

Impact

When a lender is nuked from orbit, his/her supply still accrues interest.

Proof of Concept

When a lender is nuked from orbit by calling function nukeFromOrbit(address accountAddress), function _blockAccount(state, accountAddress) will be called to block the lender:

  function nukeFromOrbit(address accountAddress) external nonReentrant {
    if (!IWildcatSanctionsSentinel(sentinel).isSanctioned(borrower, accountAddress)) {
      revert BadLaunchCode();
    }
    MarketState memory state = _getUpdatedState();
    _blockAccount(state, accountAddress);
    _writeState(state);
  }

A blocked lender's scaledBalance becomes 0, means no interest will be accrued to this lender:

  function _blockAccount(MarketState memory state, address accountAddress) internal {
    Account memory account = _accounts[accountAddress];
    if (account.approval != AuthRole.Blocked) {
      uint104 scaledBalance = account.scaledBalance;
      account.approval = AuthRole.Blocked;
      emit AuthorizationStatusUpdated(accountAddress, AuthRole.Blocked);


      if (scaledBalance > 0) {
        account.scaledBalance = 0;
        address escrow = IWildcatSanctionsSentinel(sentinel).createEscrow(
          accountAddress,
          borrower,
          address(this)
        );
        emit Transfer(accountAddress, escrow, state.normalizeAmount(scaledBalance));
        _accounts[escrow].scaledBalance += scaledBalance;
        emit SanctionedAccountAssetsSentToEscrow(
          accountAddress,
          escrow,
          state.normalizeAmount(scaledBalance)
        );
      }
      _accounts[accountAddress] = account;
    }
  }

However, this function does not update market state's scaledTotalSupply, the lender's supply still accrues interest.

Tools Used

Manual Review

Recommended Mitigation Steps

When a lender is nuked from orbit, his/her supply should cease to accrue interest

Assessed type

Access Control