Skip to content

Latest commit

 

History

History
68 lines (51 loc) · 2.42 KB

074.md

File metadata and controls

68 lines (51 loc) · 2.42 KB

J4de

high

LenderCommitmentForwarder.sol#updateCommitment function can change the lender to someone else

Summary

LenderCommitmentForwarder.sol#updateCommitment function can change the lender to someone else

Vulnerability Detail

File: LenderCommitmentForwarder.sol
210     function updateCommitment(
211         uint256 _commitmentId,
212         Commitment calldata _commitment
213     ) public commitmentLender(_commitmentId) {
214         require(
215             _commitment.principalTokenAddress ==
216                 commitments[_commitmentId].principalTokenAddress,
217             "Principal token address cannot be updated."
218         );
219         require(
220             _commitment.marketId == commitments[_commitmentId].marketId,
221             "Market Id cannot be updated."
222         );
223
224         commitments[_commitmentId] = _commitment;
225
226         //make sure the commitment data still adheres to required specifications and limits
227         validateCommitment(commitments[_commitmentId]);
228
229         emit UpdatedCommitment(
230             _commitmentId,
231             _commitment.lender,
232             _commitment.marketId,
233             _commitment.principalTokenAddress,
234             _commitment.maxPrincipal
235         );
236     }

The lender can call updateCommitment to update the status of the commitment that has been released. The problem here is that the lender can modify the lender of the commitment to any other person through this function.

The attack method is as follows:

  1. Alice issued a commitment worth 100 USD, and she usually approves a token worth 100 USD to the LenderCommitmentForwarder contract
  2. Bob also issues a commitment worth 100 USD without any collateral (bob also can choose any commitment that has been released in the updateCommitment contract)
  3. Bob calls updateCommitment function to change the commitment's lender to Alias
  4. Bob accept this commitment as a borrower
  5. Bob does not need to pay back the money at all, because the loan has not collateral by any

Impact

Attackers can steal lenders' funds.

Code Snippet

https://github.com/teller-protocol/teller-protocol-v2/blob/cb66c9e348cdf1fd6d9b0416a49d663f5b6a693c/packages/contracts/contracts/LenderCommitmentForwarder.sol#L208-L233

Tool used

Manual Review

Recommendation

It is recommended that updateCommitment function cannot modify the commitment's lender