The Wildcat Protocol - devival's results

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/market/WildcatMarket.sol#L86

Vulnerability details

Impact

According to the docs, the lender that deposits 133.7 XYZ tokens into a market will receive 133.7 market tokens - with the market token name depending on what was selected by the borrower when the market was launched.

However, the above architecture does not handle the case when XYZ is a rebasing (or elastic) token whose supply is algorithmically adjusted. The issue might lead to a permanent loss of funds as tokens would stay locked in the contract.

The issue also breaks the following property: The supply of the market token and assets owed by the borrower should always match.

Proof of Concept

Wildcat-Gitbook#deposits WildcatMarket.sol#L86

Tools Used

Manual Review

Recommended Mitigation Steps

1. You can explicitly state in the documentation that you do not support rebasing mechanism.
2. Alternatively, when rebasing tokens go down in value, you should have a method to update the market tokens' balances accordingly. And when they go up in value, you should add a method to actually transfer the excess tokens out of the protocol. This is a complex solution.

Assessed type

ERC20

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/libraries/FeeMath.sol#L45

Vulnerability details

Impact

As mentioned in the previous audit by aleph_v, protocol fees can be bypassed while still paying the same rate to the lenders. The issue was neither resolved nor acknowledged.

Proof of Concept

The overall interest paid by the borrower is the interest times the protocol fee plus any delinquency fees. By setting the delinquency fee percent to the intended interest and then setting the protocol interest percent to zero (or close to zero) the borrower can construct a vault which pays the lenders the same amount of interest via delinquency fees as it would pay via interest. The borrower can increase the liquidity requirements to force payment of persistent delinquency fees. In this case the lenders have no incentive to withdraw as they get the same rate and borrowers pay a net lower fee as no protocol fee is collected. aleph_v, FeeMath.sol#L45

Tools Used

Manual Review

Recommended Mitigation Steps

Charge protocol fees on the extra interest which is paid by delinquent loans.

Assessed type

Other