Boost _ Folks Finance 33978 - [Smart Contract - Critical] Attacker can Inflate effectiveCollateralValue
Submitted on Sat Aug 03 2024 06:43:07 GMT-0400 (Atlantic Standard Time) by @arno for Boost | Folks Finance
Report ID: #33978
Report type: Smart Contract
Report severity: Critical
Target: https://testnet.snowtrace.io/address/0x2cAa1315bd676FbecABFC3195000c642f503f1C9
Impacts:
Protocol insolvency
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Description
Brief/Intro
A user can exploit the LoanManager::deposit()
function to deposit a 0 token amount for a specific loanID, resulting in the colPools
array containing duplicate loanIDs of the same pool. This causes the UserLoanLogic::getLoanLiquidity
function, which calculates effectiveCollateralValue
by iterating through all poolIds in the colPools
array, to return an incorrect and inflated effectiveCollateralValue
. This vulnerability can be exploited in various scenarios, leading to significant issues within the protocol.
Vulnerability Details
In the protocol, users can deposit collateral using the LoanManager::deposit()
function, which allows them to pass any amount, including 0.
Code Snippet: LoanManager::deposit()
LoanManager::deposit()
Code Snippet: executeDeposit
Function in LoanManagerLogic
executeDeposit
Function in LoanManagerLogic
Calculation of fAmount
fAmount
The fAmount
is calculated based on the amount
input:
Rounding Issue in fAmount
fAmount
When the amount is not 0, the fAmount
can round down to 0 as well in certain cases:
increaseCollateral
Function
increaseCollateral
FunctionThe increaseCollateral
function then adds the poolId to the colPools
array if the balance was previously 0:
This indicates that when a user deposits for the first time into the pool, if the balance is 0, the poolId
is pushed to the colPools
array, and the associated balance for that pool is increased. By passing a 0 token amount, this function will keep pushing the poolId
to the colPools
array, causing it to contain duplicate pool IDs. This can be exploited to inflate the effectiveCollateralValue
in the UserLoanLogic::getLoanLiquidity()
function.
Code Snippet: Inflating effectiveCollateralValue
effectiveCollateralValue
Attack Path
Alice deposits a small amount of collateral in Pool A and Pool B.
Bob discovers that by depositing 0 tokens multiple times, the same Pool ID is repeatedly added to his
colPools
array.Bob exploits this by inflating his
effectiveCollateralValue
, allowing him to:Borrow significantly more than he should be able to.
Bypass the
isLoanOverCollateralized
checks, enabling him to withdraw collateral while having outstanding loans.Avoid liquidation since the inflated
effectiveCollateralValue
prevents his loan from being flagged as under-collateralized.
Impact Details
If exploited, this vulnerability could lead to significant financial losses within the protocol. The inflated effectiveCollateralValue
could allow users to borrow more than they should, withdraw collateral they aren't entitled to, or avoid liquidation, potentially resulting in insolvency of the protocol and loss of funds for all users.