Lybra Finance - gs8nrv's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/base/LybraPeUSDVaultBase.sol#L192

Vulnerability details

Impact

The debt when repaying is not updated correctly it doesn't take into account the fees paid. After computing the updated fees, the code check whether the repayment is larger than the fees that must be paid or not. It then decreases the stored fee, but does not update the updated repayment amount. Leading to decrease more than expected the borrowed amount (not taking into account the fees paid).

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Recommended Mitigation Steps

The code should be:

        if (amount >= totalFee) {
            feeStored[_onBehalfOf] = 0;
            PeUSD.transferFrom(_provider, address(configurator), totalFee);
            PeUSD.burn(_provider, amount - totalFee);
            amount-=totalFee;
        } else {
            feeStored[_onBehalfOf] = totalFee - amount;
            PeUSD.transferFrom(_provider, address(configurator), amount);
            amount=0;
        }

Assessed type

Other

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/configuration/LybraConfigurator.sol#L127 https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/configuration/LybraConfigurator.sol#L202

Vulnerability details

Impact

The check made is not coherent with link #2 in setSafeCollateralRatio. It allows to set the bad collateral ratio larger than the safe collateral ratio, and would allow full liquidation to unwanted collateral ratio.

The

Proof of Concept

Link #1

Recommended Mitigation Steps

The line should be

require(newRatio >= 130 * 1e18 && newRatio <= 150 * 1e18 && newRatio+ 1e19 <= vaultSafeCollateralRatio[pool],"LNA");

Assessed type

Governance