The Wildcat Protocol - erictee's results

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarket.sol#L142

Vulnerability details

Impact

The function closeMarket() in WildcatMarket.sol:

function closeMarket() external onlyController nonReentrant {
    MarketState memory state = _getUpdatedState();
    state.annualInterestBips = 0;
    state.isClosed = true;
    state.reserveRatioBips = 0;
    if (_withdrawalData.unpaidBatches.length() > 0) {
      revert CloseMarketWithUnpaidWithdrawals();
    }
    uint256 currentlyHeld = totalAssets();
    uint256 totalDebts = state.totalDebts();
    if (currentlyHeld < totalDebts) {
      // Transfer remaining debts from borrower 
      asset.safeTransferFrom(borrower, address(this), totalDebts - currentlyHeld);//@audit no approve before?? will this function revert?
    } else if (currentlyHeld > totalDebts) {
      // Transfer excess assets to borrower
      asset.safeTransfer(borrower, currentlyHeld - totalDebts); //@audit need to double check the calculation here, might have critical finding here.
    }
    _writeState(state);
    emit MarketClosed(block.timestamp);
  }
}

Notice that there is onlyController modifier which indicates this function can only be called from WildcatMarketController.sol contract.

However, this function is not implemented anywhere in WildcatMarketController.sol, making this function completely unusable. Borrowers who try to call this function directly from WildcatMarket.sol will get reverted with NotController() error message.

As a result, funds will be lost as both protocol cannot claim remaining debts from borrower if market is not fully collateralized and borrowers cannot reclaim any assets in excess of debts.

Proof of Concept

https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarket.sol#L142

Tools Used

Manual analysis

Recommended Mitigation Steps

Implement closemarket() function in WildcatMarketController.sol and make sure access control is set appropriately.

Assessed type

Other