Lybra Finance - smaul's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/pools/LybraWbETHVault.sol#L35 https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/pools/LybraWbETHVault.sol#L10

Vulnerability details

Impact

There is no function name called exchangeRatio in original WBETH contract (https://etherscan.io/address/0xa2e3356610840701bdf5611a53974510ae27e2e1) but in the LybraWbETHVault.sol contract getAssetPrice function is using exchangeRatio function of WBETH contract which result revert and the code will not be working.

Proof of Concept

function getAssetPrice() public override returns (uint256) {
        return (_etherPrice() * IWBETH(address(collateralAsset)).exchangeRatio()) / 1e18;
    }

check original WBETH contract (https://etherscan.io/address/0xa2e3356610840701bdf5611a53974510ae27e2e1) there is no exchangeRatio function present

Recommended Mitigation Steps

Use the right function else the code will revert

Assessed type

DoS

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/configuration/LybraConfigurator.sol#L127

Vulnerability details

Impact

According the protocol requirements vaultSafeCollateralRatio should be higher then vaultBadCollateralRatio but in setBadCollateralRatio function it's possible to set vaultSafeCollateralRatio to less then vaultBadCollateralRatio. Which means user collateral could be potentially in safecollateralratio but still in the badcollateralration and result his collateral will be liquid able

Proof of Concept

function setBadCollateralRatio(address pool, uint256 newRatio) external onlyRole(DAO) {
        require(newRatio >= 130 * 1e18 && newRatio <= 150 * 1e18 && newRatio <= vaultSafeCollateralRatio[pool] + 1e19, "LNA");
        vaultBadCollateralRatio[pool] = newRatio;
        emit SafeCollateralRatioChanged(pool, newRatio);
    }

Suppose vaultSafeCollateralRatio[pool] is between 130 * 1e18 to 140 * 1e18. So, according to this require statement newRatio <= vaultSafeCollateralRatio[pool] + 1e19 it's possible to set the vaultBadCollateralRatio between 130 * 1e18 to 140 * 1e18 according to the vaultSafeCollateralRatio.

Tools Used

Manual

Recommended Mitigation Steps

The require statement should check for newRatio <= vaultSafeCollateralRatio[pool] - 1e19 this. So, badcollateralratio can never be higher then safecollateralratio.

Assessed type

Invalid Validation