Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vulnerability & Bug Fixes #25

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

betmoardotfun
Copy link

Main changes are

  1. unintended delegate call due to pow function being public instead of internal (found out issue when testing post deployment)
  2. vulnerability introduced due to auction interest calculation not starting from InterestLib.ONE
  3. correction of error where requestId & offerId usage appears to be swapped accidentally

More details are in the individual commit descriptions. Looking forward to contributing back and making the repository better, learnt a lot diving into the code and deploying a functional version of it.

on deployment testing observed that when this function is called it reverts as it attempts to delegatecall to a non existent contract to execute this function. fixed by changing it from public to internal.
due to the previous method of calculation it leads to value of < InterstLib.ONE when called early on. 

This results in amountOwed going to 0 over time rather than increasing as intended leading to loss for USDC lender.

Fixed by calculating the linear auction rate with a baseline from InterestLib.ONE
match vuln fix update for rate calc.
previous version used offerId for requests and requestId for offers.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant