Revert Lend - web3Tycoon's results

Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L685

Vulnerability details

Impact

When a liquidator calls Liquidate with the params containing the tokenId. The owner of the tokenId will see the transaction in the mempool and frontrun by calling repay with a small digit lets say 1%, and since the minimum amount is 0, will cause the liquidator transaction to fail because debtShares should be equal to params.debtShares.

if (debtShares != params.debtShares) {
            revert DebtChanged();
        }

Proof of Concept

1. Liquidator call liquidate , in params with tokenId
2. owner sees the transaction pending in the mempool.
3. Owner calls repay with a minimum amount above 0.
4. The transaction of the Liquidator fails because an update of debtShares happened which will not be equal to the params.debtShares

Tools Used

manual Review

Recommended Mitigation Steps

Refactor the code such as when liquidate is called on a tokenId, that should be liquidate. It locks the user to avoid to redeem his position.

Assessed type

MEV