Venus Prime - pep7siup's results

Lines of code

https://github.com/code-423n4/2023-09-venus/tree/main/contracts/Tokens/Prime/Prime.sol#L661

Vulnerability details

Impact

The impact of this vulnerability is significant. The Scores.calculateScore function expects the capital argument to have 1e18 decimal places. However, the affected line of code mistakenly scales the capital precision, which has underlying token's decimals, based on vToken decimals. Due to this incorrect scaling, certain markets may enjoy extremely large Prime rewards, while others may receive disproportionately smaller rewards. This issue affects the integrity of the protocol by causing an imbalance in reward distribution and potentially loss of funds due to mis-accounting.

Proof of Concept

The root cause of the vulnerability is that the capital argument in the _calculateScore function is incorrectly scaled based on the vToken decimals instead of the underlying decimals. Let's walk through the issue with the following scenario:

1. Alice holds Prime tokens and wants to maximize her Prime rewards.
2. Alice chooses to participate in the vUSDC market, which has 8 decimal places for vUSDC but 6 decimal places for USDC.
3. Alice borrows from the vUSDC market with the expectation of enjoying boosted rewards.
4. However, since the capital is incorrectly scaled using the vToken decimals (8), Alice's capital is 100 times smaller than expected.
5. As a result, Alice receives proportionally smaller Prime rewards than she should.

On the other hand:

1. Bob participates in the vETH market, which has 8 decimal places for vETH but 18 decimal places for ETH.
2. Due to the incorrect scaling, Bob's capital becomes extremely large, as it is scaled based on vToken decimals.
3. Bob ends up enjoying Prime rewards that are orders of magnitude larger than other markets.
4. This significantly drains the Prime rewards from other markets, causing an imbalance in the distribution of rewards.

Tools Used

Manual Review

Recommended Mitigation Steps

To address this vulnerability, it is recommended to correctly scale the capital argument in the _calculateScore function based on the decimals of the underlying token. The following adjustment should be made:

capital = capital * (10 ** (18 - IERC20(_getUnderlying(vToken)).decimals()))

This change will ensure that the capital is correctly scaled to match the 1e18 decimal places expected by the Scores.calculateScore function.

Assessed type

Decimal

Lines of code

https://github.com/code-423n4/2023-09-venus/tree/main/contracts/Tokens/Prime/Prime.sol#L200 https://github.com/code-423n4/2023-09-venus/tree/main/contracts/Tokens/Prime/Prime.sol#L623 https://github.com/code-423n4/2023-09-venus/blob/b11d9ef9db8237678567e66759003138f2368d23/contracts/Tokens/Prime/Prime.sol#L389 https://github.com/code-423n4/2023-09-venus/blob/b11d9ef9db8237678567e66759003138f2368d23/contracts/Tokens/Prime/Prime.sol#L607

Vulnerability details

Impact

Prime functionality lacks a crucial validation of user's position health factor. This omission allows accounts with insufficient funds (especially bad debtors) to continue enjoying Prime rewards, which can result in fund losses for the protocol and eligible users.

Proof of Concept

The root cause of the vulnerability is that the Prime functions such as _initializeMarkets, updateScores, accrueInterestAndUpdateScore and _accrueInterestAndUpdateScore functions lack overall checks for account shortfall conditions. Let's walk through the issue with the following scenario:

1. Alice is a Prime participant. However, due to market volatility, her position falls short and she is not able to repay the debt, making her a bad debtor. Depending on market conditions, the liquidation of Alice's position might be delayed for a period of time.

2. In the mean time, Alice could still call accrueInterestAndUpdateScore function to accrue the Prime rewards and update her score as the borrow interrest keeps increasing.

3. Since there are no mechanism to prevent Alice from enjoying the Prime rewards despite her shortfall condition, Alice continues to receive Prime rewards even though she owes funds to the protocol.

4. This situation can lead to a loss of funds for the protocol and other eligible users, as Alice may not have the intention to repay her debt or leave the Prime program.

5. Protocol has to go through VIP process to burn Alice's Prime token which is time consuming and is not ideal to handle situations like this.

Tools Used

Manual Review

Recommended Mitigation Steps

To address this vulnerability, it is recommended to revise and implement checks for account shortfall conditions where the Prime scores are updated. If an account short-fallen, its Prime score should equate to 0, effectively eliminated from the program.

Assessed type

Invalid Validation