routerBalances[msg.sender][_local] can be inflated in repayAavePortal due to underflow in unchecked math

Lines of code Vulnerability details function repayAavePortal address local, uint256 backingAmount, uint256 feeAmount, uint256 maxIn, bytes32 transferId external uint256 totalAmount = backingAmount + feeAmount; // in adopted uint256 routerBalance = s.routerBalancesmsg.senderlocal; // in local //...

PortcalFacet.repayAavePortal() can trigger an underflow of routerBalances

Lines of code Vulnerability details Impact The caller of repayAavePortal can trigger an underflow to arbitrarily increase the caller's balance through an underflow. Proof of Concept // Relevant code sections: // PortalFacet.sol function repayAavePortal address local, uint256 backingAmount, uint25...