Skip to content

Latest commit

 

History

History
69 lines (60 loc) · 2.67 KB

070.md

File metadata and controls

69 lines (60 loc) · 2.67 KB

Powerful Honeysuckle Anteater

High

Borrower could use stablecoins for collateral

Summary

As specified in the README of the contest and the protocol specifications, collateral should only consist of ETH and ETH-like tokens. However, the current logic allows borrowers to borrow against all available assets, including stablecoins such as USDA and USDT.

Root Cause

There is no verification to ensure that only ETH and ETH-like tokens are deposited as collateral. Reference borrowing.sol#L226-L255

    function depositTokens(
        BorrowDepositParams memory depositParam
    ) external payable nonReentrant whenNotPaused(IMultiSign.Functions(0)) {
        // Assign options for lz contract, here the gas is hardcoded as 400000, we got this through testing by iteration
        bytes memory _options = OptionsBuilder.newOptions().addExecutorLzReceiveOption(400000, 0);
        // calculting fee
        MessagingFee memory fee = globalVariables.quote(
            IGlobalVariables.FunctionToDo(1),
@>>         depositParam.assetName,
            _options,
            false
        );
        // Get the exchange rate for a collateral and eth price
@>>     (uint128 exchangeRate, uint128 ethPrice) = getUSDValue(assetAddress[depositParam.assetName]);

        totalNormalizedAmount = BorrowLib.deposit(
            BorrowLibDeposit_Params(
                LTV,
                APR,
                lastCumulativeRate,
                totalNormalizedAmount,
                exchangeRate,
                ethPrice,
                lastEthprice
            ),
@>>         depositParam,
            Interfaces(treasury, globalVariables, usda, abond, cds, options),
            assetAddress
        );

........
    }

Enum:

   enum AssetName {
        DUMMY,
        ETH,
        WeETH,
        WrsETH,
        rsETH,
        USDa,
        ABOND,
        TUSDT
    }

Attack Path

A user attempts to borrow USDA against USDT/USDA. In the current codebase, this is allowed because there are no checks in place to prevent it. However, this contradicts the project's documentation and workflow: Autonomint Docs.

Impact

  • This could lead to pegging issues for the USDA asset if it can be borrowed against itself, as this is not how the hedging mechanism is intended to work.
  • It deviates from the intended protocol workflow.

Mitigation

Implement a check to limit the types of borrowing assets to only those that are allowed.