Upgraded Q -> H from #439 [1670433195074]

Judge has assessed an item in Issue 439 as H risk. The relevant finding follows: L02 - close should not be able to close a specific id credit line As per the docs: Can a Borrower chose to repay any debt in any order? No. The app automatically selects which credit line can be repaid using a...

Upgraded Q -> M from #366 [1670366212013]

Judge has assessed an item in Issue 366 as M risk. The relevant finding follows: 1. Not support fee-on-transfer tokens Every tokens of credit line will be transferred from lender to LineOfCredit first, then to borrower later. These 2-transfer steps will make the tax for some fee-on-transfer token...

Closing a single credit line can be reentered and allows closing all open credit lines

Lines of code Vulnerability details Closing a single credit line can be reentered and allows decrementing count as many times as needed to reach the value 0. As soon as the value is 0, the status of all credit lines will be updated to LineLib.STATUS.REPAID. Reentrancy is possible by the borrower ...

Repaying a line of credit with a higher than necessary claimed revenue amount will force the borrower into liquidation

Lines of code Vulnerability details A borrower can repay parts of a credit line with the SpigotedLine.useAndRepay function. This function will use amount of unusedTokenscredit.token as a repayment. However, if amount exceeds the principal and the accrued interest, credit.principal will underflow...

Borrower can close non-existent credit line positions to effectively force the overall status to REPAID

Lines of code Vulnerability details The LineOfCredit.close function is used to close a credit line position. Both the lender of a specific credit position and the borrower can call this function. However, the function does not check if the given id belongs to a credit line position in the credits...

Borrower can manipulate the repayment queue, avoid paying back the initial lender

Lines of code Vulnerability details Impact In contract LineOfCredit, the repayment queue protects lenders and assured that they have to get paid back. Without a queue, a borrower could constantly refinance to lower rates and avoid paying back the initial lender from sponsors. Every time, borrower...

_withdrawLiquidity() is Not Consistent With start()

Lines of code Vulnerability details Impact withdrawLiquidity details a number of scenarios under which a user may withdraw their liquidity. The first two scenarios outline cases where the credit line has either been cancelled by the borrower or insufficient assets have been lent out to the pool b...

[WP-H1] LenderPool.sol#terminate() Wrong value is used for the shares argument of SAVINGS_ACCOUNT.withdrawShares() can cause fund loss to all users

Lines of code Vulnerability details / @notice Function invoked when pooled credit line is terminated by admin @dev only pooledCreditLineContract can invoke @param id identifier for the pooled credit line @param to address to which all the borrow tokens are transfered / function terminateuint256 i...

_withdrawLiquidity() is Not Consistent With start()

Lines of code Vulnerability details Impact withdrawLiquidity details a number of scenarios under which a user may withdraw their liquidity. The first two scenarios outline cases where the credit line has either been cancelled by the borrower or insufficient assets have been lent out to the pool b...

Existing credit line can be overwritten

Lines of code Vulnerability details Impact If pooledCLConstants1 already exists and Admin calls create function with id as 1 then pooledCLConstants1 will be overwritten with new value Proof of Concept 1. User A calls the create function to prepare a new credit line with id 1 2. This credit line i...

Borrower can stop lenders from withdrawing interest payments

Lines of code line Vulnerability details Impact A borrower can prevent lenders from being able to withdraw any interest payments. For example, a malicious borrower could create a credit line proposal with a long duration and a promise of regular interest payments to entice lenders to deposit into...

Anyone can liquidate credit line when autoLiquidation is false without supplying borrow tokens

Handle harleythedog Vulnerability details Impact It is intended that if a credit line has autoLiquidation as false, then only the lender can be the liquidator see docs here: . However, this is not correctly implemented, and anyone can liquidate a position that has autoLiquidation set to false. Ev...