Ethereum Credit Guild - twcctop's results

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/e3d3e581e0e51a9ecf3a5a0c4e4bd4af32552fc0/src/loan/LendingTerm.sol#L322-L329

Vulnerability details

Impact

_hardCap check may be bypassed and possibly get a larger debtCeiling return.

Proof of Concept

Logic error in get min of there values.

   // return min(creditMinterBuffer, hardCap, debtCeiling)
        if (creditMinterBuffer < _debtCeiling) {
@>            return creditMinterBuffer;
        }
        if (_hardCap < _debtCeiling) {
            return _hardCap;
        }
        return _debtCeiling;

the purpose of the logic is to get min value of three. The issue is when creditMinterBuffer < _debtCeiling , it will direct return and don't check the third value _hardCap , sometimes _hardCap will be set to 0, for example after forgive a loan. So the _hardCap check will be bypassed and possibly get a larger debtCeiling return.

Tools Used

manual

Recommended Mitigation Steps

change the logic of three value compare

Assessed type

Invalid Validation

L1 debtCeiling don't check _hardCap when no more borrows allowed

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/e3d3e581e0e51a9ecf3a5a0c4e4bd4af32552fc0/src/loan/LendingTerm.sol#L305-L311

   if (_issuance >= debtCeilingBefore) {
            return debtCeilingBefore; // no more borrows allowed
        }

When no more borrow allowed, it will return the minimum value of _issuance and debtCeilingBefore, but don't check the _hardCap.