Platform: Code4rena
Start Date: 28/04/2022
Pot Size: $50,000 USDC
Total HM: 7
Participants: 43
Period: 5 days
Judge: gzeon
Total Solo HM: 2
Id: 115
League: ETH
Rank: 33/43
Findings: 1
Award: $89.04
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: Dravee
Also found by: 0x1f8b, 0x4non, 0x52, 0xDjango, AlleyCat, Funen, GalloDaSballo, GimelSec, Hawkeye, MaratCerby, Picodes, berndartmueller, cccz, defsec, delfin454000, dipp, hyh, ilan, joestakey, kebabsec, luduvigo, pauliax, peritoflores, robee, rotcivegaf, samruna, shenwilly, sikorico, simon135, sorrynotsorry, unforgiven, z3s
89.0354 USDC - $89.04
Mistakenly setting _vaultConfig.liquidationFee to be higher than WadRayMath.wad() will make liquidatePartial unusable, which could lead to admin losing funds due to bad debts not being able to be liquidated.
This is particularly dangerous as vaultConfig cannot be updated and the faulty setting can remain undetected until market movement causes bad debts. Malicious actors can borrow as much as possible without worrying about getting liquidated.
Require _vaultConfig.liquidationFee to be lower than WadRayMath.wad() during initialisation in the constructor.
#0 - m19
2022-05-05T08:53:15Z
Technically true, but requires passing wrong configuration to an Inception Vault, Inception Vaults can be easily recreated.
#1 - gzeoneth
2022-06-05T16:40:19Z
Treating as warden's QA report.