Skip to content

Latest commit

 

History

History
61 lines (44 loc) · 2.8 KB

010.md

File metadata and controls

61 lines (44 loc) · 2.8 KB

Tiny Gingerbread Tarantula

High

Funds Added to Non-Perpetual Offers Due to Missing Validation Check

Summary

The addFunds function allows funds to be added to a loan offer even when the perpetual flag is set to false, despite the protocol’s expectation (as declared in payDebt) that funds should only be added to perpetual lend orders. This creates logical inconsistencies and potential misuse, enabling lenders to repeatedly add funds to non-perpetual offers and cancel them to withdraw funds. However, the delete operation will prevent the lender from withdrawing these funds, effectively locking them within the contract.

Root Cause

The root cause of the issue is the missing validation check for the perpetual flag in the addFunds function. The function does not verify whether the loan offer is marked as perpetual (perpetual == true) before allowing additional funds to be added. Consequently, funds can be locked or mismanaged in non-perpetual offers, enabling unintended behavior such as repeated cancellations and deletions.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  • order can only be deleted once on the DLOFactory
  • Aggregator accept partial amount to fulfil lending offer
  • User cancel the offer to withdraw available amount.
  • Aggregator add funds during repayment

Impact

Funds added to a deleted order via addFunds() after the offer is canceled cannot be withdrawn, leading to permanent lock-up. The ability to add funds to non-active offers creates logical inconsistencies in the protocol’s expected behavior. Users lose access to their capital after first deletion

PoC

No response

Mitigation

function addFunds(uint amount) public nonReentrant {
    require(
        lendInformation.perpetual,
        "Cannot add funds to a non-perpetual loan"
    );
    require(
        msg.sender == lendInformation.owner ||
            IAggregator(aggregatorContract).isSenderALoan(msg.sender),
        "Only owner or loan can add funds"
    );
    SafeERC20.safeTransferFrom(
        IERC20(lendInformation.principle),
        msg.sender,
        address(this),
        amount
    );
    lendInformation.availableAmount += amount;
    IDLOFactory(factoryContract).emitUpdate(address(this));
}