Fraxlend (Frax Finance) contest - minhquanym's results

Lines of code

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairCore.sol#L194

Vulnerability details

Impact

In FraxlendPairCore.constructor() function, value of dirtyLiquidationFee should be 90% of clean fee (in comment). But actually, in implementation, it’s only equal to 9% of clean fee because LIQ_PRECISION = 1e5 and 9000 is only 9% of 1e5.

This basically resulted in less amount of collateral liquidators will receive in liquidateClean() function.

Proof of Concept

Line 194 init value of dirtyLiquidationFee

dirtyLiquidationFee = (_liquidationFee * 9000) / LIQ_PRECISION; // 90% of clean fee

This variable is used to calculate amount of collateral received by liquidators in line 988-990

_collateralForLiquidator = _leftoverCollateral <= 0
    ? _userCollateralBalance
    : (_liquidationAmountInCollateralUnits * (LIQ_PRECISION + dirtyLiquidationFee)) / LIQ_PRECISION;

Tools Used

Manual Review

Recommended Mitigation Steps

Fix line 194 to

dirtyLiquidationFee = (_liquidationFee * 90000) / LIQ_PRECISION;

Lines of code

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairConstants.sol#L41 https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/LinearInterestRate.sol#L34 https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/VariableInterestRate.sol#L40 https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/VariableInterestRate.sol#L41

Vulnerability details

Impact

All annual rate constants in the system are calculated with an assumption that block time is 15 second (actually it’s from 12 to 14 seconds as in the documentation. And these constants are used to calculate rate in rate calculator and also used to reset interest rate when there are no borrows.

But actually, the merge is really near and after the merge blocks come exactly each 12 seconds which basically makes all these constants wrong.

This resulted in wrong interest rate after reseting when there are no borrows and wrong rate returned by rate calculators.

Proof of Concept

These annual rate is calculated by solving an equation for r with an assumption 365.24 days per year and 15s blocks. For example, this is for the 0.5% annual rate

1.005 = (1 + 15*r)^(365.24 * 24 * 3600 / 15)

But actually after the merge, blocks come in exactly each 12 seconds. Check out this blog post of Tim Beiko

Line 431-433 reset interest rate when there are no borrows

if (!paused()) {
    _currentRateInfo.ratePerSec = DEFAULT_INT;
}

These constants are used in requireValidInitData() and also getNewRate() function in rate calculators and wrong constants might make getNewRate() return wrong value. For example, line 72-74 used MIN_INT as new interest rate

if (_newRatePerSec < MIN_INT) {
    _newRatePerSec = MIN_INT;
}

Tools Used

Manual Review

Recommended Mitigation Steps

Consider to update these constants with an assumption that block time is 12 seconds.