Lybra Finance - y51r's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/configuration/LybraConfigurator.sol#L339

Vulnerability details

The getBadCollateralRatio function may lead to a potential underflow if vaultSafeCollateralRatio[pool] is not set before performing the subtraction. This issue can result in unexpected behavior and compromise the correctness of the calculations.

Impact

• If vaultSafeCollateralRatio[pool] is not set (i.e., equals zero), subtracting 1e19 from it can result in an underflow.
• Underflow can lead to unintended large values or even wraparound, compromising the integrity of the calculations.
• Incorrect calculations of the bad collateral ratio can impact decision-making processes and compromise the overall functionality of the system.

Proof of Concept

To demonstrate the issue, consider the following scenario:

• Assume vaultSafeCollateralRatio[pool] is not set, resulting in a value of zero.
• The function is called with the given scenario.

In this scenario, when executing the function, the subtraction vaultSafeCollateralRatio[pool] - 1e19 will result in an underflow, producing a potentially large and incorrect value as the return. The function execution will revert.

Tools Used

Manual review

Recommended Mitigation Steps

To address this issue, it is recommended to perform a check to ensure that vaultSafeCollateralRatio[pool] is not zero before performing the subtraction.

Assessed type

Under/Overflow

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/configuration/LybraConfigurator.sol#L202

Vulnerability details

The setSafeCollateralRatio function contains a potential issue where the requirement for newRatio >= vaultBadCollateralRatio[pool] + 1e19 may not be handled correctly if vaultBadCollateralRatio[pool] does not exist in the mapping. This issue affects the reliability and functionality of the code.

Impact

• If vaultBadCollateralRatio[pool] does not exist, any newRatio value greater than or equal to 1e19 will bypass the requirement check.
• This could lead to unintended behavior and compromise the security of the system.
• Incorrect handling of the mapping access can undermine the integrity and reliability of the collateral ratio requirement.

Proof of Concept

To demonstrate the issue, consider the following scenario:

• Assume vaultBadCollateralRatio[pool] does not have a value for the given pool.
• Let's assume the function is called with newRatio greater than or equal to 1e19. In this scenario, the requirement check newRatio >= vaultBadCollateralRatio[pool] + 1e19 will pass, regardless of the actual value of newRatio. This could allow the setting of an invalid vaultSafeCollateralRatio[pool] without the appropriate constraint.

Tools Used

Manual review

Recommended Mitigation Steps

To address this issue, it is recommended to perform a check to ensure that vaultBadCollateralRatio[pool] exists before evaluating the requirement.

Assessed type

Invalid Validation