Ethereum Credit Guild - mussucal's results

A trust minimized pooled lending protocol.

General Information

Platform: Code4rena

Start Date: 11/12/2023

Pot Size: $90,500 USDC

Total HM: 29

Participants: 127

Period: 17 days

Judge: TrungOre

Total Solo HM: 4

Id: 310

League: ETH

Ethereum Credit Guild

Findings Distribution

Researcher Performance

Rank: 112/127

Findings: 1

Award: $15.21

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

15.2071 USDC - $15.21

Labels

bug
2 (Med Risk)
downgraded by judge
insufficient quality report
partial-50
edited-by-warden
duplicate-708

External Links

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/LendingTerm.sol#L323-L330

Vulnerability details

Impact

Return value of LendingTerm.debtCeiling() is incorrect.

Proof of Concept

It is supposed to be the min(creditMinterBuffer, hardCap, debtCeiling). But implementation may return a higher value than intended. As a result of which decrementGauge() will not throw an error (debt ceiling used) when it should and will allow GUILD holders to decrease their exposure to a riskier term making the system imbalanced.

Tools Used

Manual.

Use the following with appropriate variable names return (a < b ? a : b) < c ? (a < b ? a : b) : c

Assessed type

Context

#0 - c4-pre-sort

2024-01-02T19:42:43Z

0xSorryNotSorry marked the issue as insufficient quality report

#1 - c4-judge

2024-01-23T11:58:15Z

Trumpero marked the issue as unsatisfactory: Insufficient quality

#2 - c4-judge

2024-01-31T11:19:32Z

Trumpero marked the issue as duplicate of #708

#3 - c4-judge

2024-01-31T11:19:57Z

Trumpero marked the issue as partial-50

#4 - c4-judge

2024-01-31T13:41:25Z

Trumpero changed the severity to 2 (Med Risk)

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter