Debt DAO contest - everyanykey's results

A cryptonative credit marketplace for fully anon and trustless loans to DAOs.

General Information

Platform: Code4rena

Start Date: 03/11/2022

Pot Size: $115,500 USDC

Total HM: 17

Participants: 120

Period: 7 days

Judge: LSDan

Total Solo HM: 1

Id: 174

League: ETH

Debt DAO

Findings Distribution

Researcher Performance

Rank: 112/120

Findings: 1

Award: $12.20

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

Awards

12.2024 USDC - $12.20

Labels

bug
2 (Med Risk)
partial-25
duplicate-367

External Links

Lines of code

https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/LineOfCredit.sol#L401-L403

Vulnerability details

Description

There are ERC20 tokens, which apply intenal fee on transfers (such as USDT), so that amount of received tokens could differ from requested amount. There is a line https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/LineOfCredit.sol#L401 where contract receives facilityFee as an amount of tokens. The same variable is used on the next line https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/LineOfCredit.sol#L403. But that facilityFee may not reflect actual balance of ERC20 tokens on the contract

Remediation

Consider getting balance of tokens using balanceOf function after receiveTokenOrETH and before _repay call.

#0 - c4-judge

2022-11-17T16:44:09Z

dmvt marked the issue as duplicate of #26

#1 - c4-judge

2022-12-06T16:35:09Z

dmvt marked the issue as partial-25

#2 - C4-Staff

2022-12-20T06:01:34Z

liveactionllama marked the issue as duplicate of #367

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter