Audinarey - wrong amount of collateral is returned to the borrower when claiming collateral

[sherlock-admin2]

Audinarey

High

wrong amount of collateral is returned to the borrower when claiming collateral

Summary

No response

Root Cause

Given

• lendInfo.maxLTVs[collateralIndex]) = 80%
• priceCollateral_LendOrder = 1e8
• pricePrinciple = 3000e8
• principleDecimals = 18
• porcentageOfRatioPerLendOrder[i] = 100%
• offer.principleAmount = 1e18

File: DebitaV3Aggregator.sol
451:                 uint fullRatioPerLending = (priceCollateral_LendOrder *
452:                     10 ** 8) / pricePrinciple;

451:                 uint fullRatioPerLending = 1e8 * 10**8 / 3000e8 = 33,333

Also,

File: DebitaV3Aggregator.sol
453:                 uint maxValue = (fullRatioPerLending *
454:                     lendInfo.maxLTVs[collateralIndex]) / 10000;

453:                 uint maxValue = 33,333 * 8000 / 10000 = 26,666

Then,

File: DebitaV3Aggregator.sol
457:                 maxRatio = (maxValue * (10 ** principleDecimals)) / (10 ** 8);

457:                 maxRatio = 26,666 * 10**18 / (10 ** 8) = 266,660,000,000,000

Lastly,

File: DebitaV3Aggregator.sol
461:             // calculate ratio based on porcentage of the lend order
462:             uint ratio = (maxRatio * porcentageOfRatioPerLendOrder[i]) / 10000;


462:             uint ratio = 266,660,000,000,000 * 10000 / 10000 = 266,660,000,000,000

The amount returned is

File: DebitaV3Loan.sol
524:     function claimCollateralERC20AsBorrower(uint[] memory indexs) internal {
525:         require(loanData.isCollateralNFT == false, "Collateral is NFT");
526: 
527:         uint collateralToSend;
528:         for (uint i; i < indexs.length; i++) {
529:             infoOfOffers memory offer = loanData._acceptedOffers[indexs[i]];
530:             require(offer.paid == true, "Not paid");
531:             require(offer.collateralClaimed == false, "Already executed");
532:             loanData._acceptedOffers[indexs[i]].collateralClaimed = true;
533:             uint decimalsCollateral = ERC20(loanData.collateral).decimals();
534:             collateralToSend +=
535:                 (offer.principleAmount * (10 ** decimalsCollateral)) /
536:                 offer.ratio;
537:         }



534:             collateralToSend = 1e18 * 1e6 / 266,660,000,000,000 = 3,750,093,752

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Wrong amount is returned to the lender

PoC

No response

Mitigation

No response