Skip to content

Latest commit

 

History

History
33 lines (24 loc) · 1.22 KB

012.md

File metadata and controls

33 lines (24 loc) · 1.22 KB

Bauer

medium

Volume not update

Summary

The protocol does not update the lenderVolumeFilled[address(bid.loanDetails.lendingToken)][sender] and totalVolumeFilled[address(bid.loanDetails.lendingToken)] value ,

Vulnerability Detail

The lenderAcceptBid() function is used to accept a proposed loan bid for a lender. At the end of the function, the protocol record volume filled by lenders as the code below. However,the protocol does not update the value after the borrower has repaid the loan or after the loan has been liquidated. It may cause confusion in the protocol bookkeeping

   // Record volume filled by lenders
        lenderVolumeFilled[address(bid.loanDetails.lendingToken)][sender] += bid
            .loanDetails
            .principal;
        totalVolumeFilled[address(bid.loanDetails.lendingToken)] += bid
            .loanDetails
            .principal;

Impact

It may cause confusion in the protocol bookkeeping

Code Snippet

https://github.com/sherlock-audit/2023-03-teller/blob/main/teller-protocol-v2/packages/contracts/contracts/TellerV2.sol#L543-L548

Tool used

Manual Review

Recommendation

Update the value after borrower has repaid the loan or after the loan has been liquidated.