The Wildcat Protocol - smiling_heretic's results

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/market/WildcatMarket.sol#L142

Vulnerability details

Impact

market.closeMarket should allow the borrower to repay all debts and then stop paying interest on deposits of lenders (i.e. set APR to zero). The purpose of this function is described in more detail here.

Assuming that constraints.minimumAnnualInterestBips is non-zero and correctly enforced, closeMarket might be the only way for the borrower to exit the market and stop paying interest.

However, because of onlyController modifier on market.closeMarket and no way to call this function from the WildcatMarketController contract, borrower is unable to close the market.

This will force the borrower to pay interest forever (or at least as long as lenders want, or resolve the issue with help of lawyers).

Proof of Concept

1. Examine this line of code to see that the access control modifier on market.closeMarket function is onlyController.
2. Examine the following lines of code (1, 2, 3, 4) to make sure that this modifier indeed enforces that msg.sender is the WildcatMarketController contract that has deployed the market.
3. Look through all external calls in WildcatMarketController contract and notice that none of them allow to call market.closeMarket function (or simply search for "closeMarket" in this file).

Tools Used

Manual Analysis

Recommended Mitigation Steps

Change onlyController modifier on closeMarket function to onlyBorrower. Alternatively, add a function to WildcatMarketController that allows the borrower to close the market.

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/WildcatMarketController.sol#L468

Vulnerability details

Impact

From the Main Invariants section of the competition description, we learn that "Market parameters should never be able to exit the bounds defined by the controller which deployed it."

Also in Attack Ideas, there's "Consider ways in which market interest rates can be manipulated to produce results that are outside of controller-specific limits".

These constraints are enforced when deploying new markets. However, they're not enforced in the controller.setAnnualInterestBips function.

This allows the borrower to exit bounds defined by the controller for market.annualInterestBips by simply calling the controller.setAnnualInterestBips function with annualInterestBips argument from outside of these bounds.

Proof of Concept

Edit constants in test/shared/TestConstants.sol file:

// uint16 constant MinimumAnnualInterestBips = 0;
// uint16 constant MaximumAnnualInterestBips = 10_000;

uint16 constant MinimumAnnualInterestBips = 1_000;
uint16 constant MaximumAnnualInterestBips = 8_000;

Add the following test to the test file: test/WildcatMarketController.t.sol:

    function test_setAnnualInterestBips_DecreaseBelowConstraints() public {
        vm.prank(borrower);
        controller.setAnnualInterestBips(address(market), DefaultInterest - 10);
        _check(
            DefaultInterest - 10,
            9000,
            DefaultReserveRatio,
            block.timestamp + 2 weeks
        );

        MarketParameterConstraints memory constraints = controller
            .getParameterConstraints();
        assertEq(constraints.minimumAnnualInterestBips, 1000);
        assertEq(market.annualInterestBips(), 990);
        assertLt(
            market.annualInterestBips(),
            constraints.minimumAnnualInterestBips
        );
    }

Run forge test --match-test test_setAnnualInterestBips_DecreaseBelowConstraints

Tools Used

Foundry, manual analysis

Recommended Mitigation Steps

In controller.setAnnualInterestBips function, enforce that market.annualInterestBips stays between constraints.minimumAnnualInterestBips and constraints.maximumAnnualInterestBips.

Another thing to consider is: is setting reserveRatioBips to 90% really ok, even if it happens to be outside of controller's constraints (constraints.minimumReserveRatioBips, constraints.maximumReserveRatioBips)?

Assessed type

Invalid Validation