Moonwell - lanrebayode77's results

Lines of code

https://github.com/code-423n4/2023-07-moonwell/blob/fced18035107a345c31c9a9497d0da09105df4df/src/core/Comptroller.sol#L232-L233

Vulnerability details

Impact

The mintAllowed function in Compotroller.sol that Checks if the account should be allowed to mint tokens in the given market will begin to fail if totalReserves becomes more than totalCash + totalBorrows, this will cause the function to revert unexpectedly in other to prevent underflow.

Proof of Concept

The design does not make provision to handle a scenario where the totalReserves becomes more than totalCash + totalBorrows

// totalSupplies = totalCash + totalBorrows - totalReserves
            uint totalSupplies = sub_(add_(totalCash, totalBorrows), totalReserves);

Tools Used

Manual review.

Recommended Mitigation Steps

Include a conditional statement to cater for such condition.

if(totalCash + totalBorrows  >  totalReserve){
// totalSupplies = totalCash + totalBorrows - totalReserves
            uint totalSupplies = sub_(add_(totalCash, totalBorrows), totalReserves);
} else {
action....
}

Assessed type

Math