Ethereum Credit Guild - wangxx2026's results

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/SurplusGuildMinter.sol#L229 https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/SurplusGuildMinter.sol#L166 https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/SurplusGuildMinter.sol#L298

Vulnerability details

Impact

This will result in the guildReward not being fetched properly, and the unstake and updateMintRatio methods not running properly. If unstake does not work properly, the pledged assets will not be redeemed properly, and if updateMintRatio does not work properly, the mintratio will not be updated properly, which will affect the leverage level.

Proof of Concept

The implementation of getRewards is as follows: https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/SurplusGuildMinter.sol#L216-L290

    function getRewards(
        address user,
        address term
    )
        public
        returns (
            uint256 lastGaugeLoss, // GuildToken.lastGaugeLoss(term)
            UserStake memory userStake, // stake state after execution of getRewards()
            bool slashed // true if the user has been slashed
        )
    {
        bool updateState;
        lastGaugeLoss = GuildToken(guild).lastGaugeLoss(term);
 --->       if (lastGaugeLoss > uint256(userStake.lastGaugeLoss)) { // userStake is not assigned a value, it is just declared in returns. lastGaugeLoss is always 0.
            slashed = true;
        }

        // if the user is not staking, do nothing
--->        userStake = _stakes[user][term]; // The correct way to use it is to use userStake.lastGaugeLoss after this line.
        if (userStake.stakeTime == 0)
            return (lastGaugeLoss, userStake, slashed);
...

            if (slashed) {
--->                guildReward = 0; // guildReward cannot be taken
            }
...


    }

Both unstake and updateMintRatio depend on slashed not being true in order to work properly. If true, unstake won't work and all pledged assets won't be redeemed, and updateMintRatio won't work properly causing mintratio to not be updated properly and affecting leverage levels

Tools Used

Manual Review

Recommended Mitigation Steps

After userStake = _stakes[user][term] is assigned, then call the following code:

     if (lastGaugeLoss > uint256(userStake.lastGaugeLoss)) {
            slashed = true;
     }

Assessed type

Context