The Wildcat Protocol - gumgumzum's results

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarket.sol#L133-L162 https://github.com/code-423n4/2023-10-wildcat/blob/main/src/WildcatMarketController.sol#L468-L488

Vulnerability details

Impact

According the documentation, borrowers should be able to close markets but they can't since WildcatMarket@closeMarket is only callable by the WildcatMarketController and is not used anywhere there.

Proof of Concept

The documentation describes closing markets as a special case of reducing APR but WildcatMarketController@setAnnualInterestBips is missing logic for that.

WildcatMarket.sol

  function closeMarket() external onlyController nonReentrant {
    // ...
  }

WildcatMarketController.sol

  function setAnnualInterestBips(
    address market,
    uint16 annualInterestBips
  ) external virtual onlyBorrower onlyControlledMarket(market) {
    // If borrower is reducing the interest rate, increase the reserve
    // ratio for the next two weeks.
    if (annualInterestBips < WildcatMarket(market).annualInterestBips()) {
      TemporaryReserveRatio storage tmp = temporaryExcessReserveRatio[market];

      if (tmp.expiry == 0) {
        tmp.reserveRatioBips = uint128(WildcatMarket(market).reserveRatioBips());

        // Require 90% liquidity coverage for the next 2 weeks
        WildcatMarket(market).setReserveRatioBips(9000);
      }

      tmp.expiry = uint128(block.timestamp + 2 weeks);
    }

    WildcatMarket(market).setAnnualInterestBips(annualInterestBips);
  }

Tools Used

Manual Review

Recommended Mitigation Steps

Add the missing logic for closing markets in WildcatMarketController.

Assessed type

Other

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarketConfig.sol#L128-L144 https://github.com/code-423n4/2023-10-wildcat/blob/main/src/libraries/MarketState.sol#L59-L61 https://github.com/code-423n4/2023-10-wildcat/blob/main/src/market/WildcatMarket.sol#L53

Vulnerability details

Impact

Maximum supply cannot be increased and by extension the max deposit limit too.

Proof of Concept

WildcatMarketConfig@setMaxTotalSupply is only callable by the WildcatMarketController but is not used anywhere there.

WildcatMarketConfig.sol

  function setMaxTotalSupply(uint256 _maxTotalSupply) external onlyController nonReentrant {
    // ...
  }

Tools Used

Manual Review

Recommended Mitigation Steps

Add the missing logic to allow the borrower to set the maximum total supply in the WildcatMarketController or change the modifier from onlyController to onlyBorrower for WildcatMarketConfig@setMaxTotalSupply.

Assessed type

Other