Venus Protocol Isolated Pools - jasonxiale's results

Lines of code

https://github.com/code-423n4/2023-05-venus/blob/8be784ed9752b80e6f1b8b781e2e6251748d0d7e/contracts/Lens/PoolLens.sol#L267-L268

Vulnerability details

Impact

PoolLens.getPoolBadDebt calculates the badDebt.badDebtUsd without scaling.

Proof of Concept

In function PoolLens.getPoolBadDebt, `` is used without scaling,

266        badDebt.badDebtUsd =
267            VToken(address(markets[i])).badDebt() *
268            priceOracle.getUnderlyingPrice(address(markets[i]));

For the rest of calling priceOracle.getUnderlyingPrice, they have been scaling such as https://github.com/code-423n4/2023-05-venus/blob/8be784ed9752b80e6f1b8b781e2e6251748d0d7e/contracts/Comptroller.sol#L1105-L1106 https://github.com/code-423n4/2023-05-venus/blob/8be784ed9752b80e6f1b8b781e2e6251748d0d7e/contracts/RiskFund/RiskFund.sol#L240-L246 https://github.com/code-423n4/2023-05-venus/blob/8be784ed9752b80e6f1b8b781e2e6251748d0d7e/contracts/Shortfall/Shortfall.sol#L393

Tools Used

VS

Recommended Mitigation Steps

Assessed type

Decimal