Brave Plum Shetland - Lack of Explicit Check for LST Token Approval

[sherlock-admin3]

Brave Plum Shetland

Medium

Lack of Explicit Check for LST Token Approval

Summary

https://github.com/sherlock-audit/2024-12-numa-audit/blob/main/Numa/contracts/NumaProtocol/NumaVault.sol#L1144-L1149
The liquidateLstBorrower function assumes that the lstAmount has been approved for transfer to the contract. If approval is not given, the function will fail.

Vulnerability Details

Vulnerability Type: Missing allowance check

Severity: Medium

Likelihood: Moderate

Impact: If the LST token is not approved for transfer to the contract, the SafeERC20.safeTransferFrom will fail, potentially preventing the liquidation process from proceeding.

Cause: The code does not explicitly verify if the contract has sufficient allowance to transfer lstAmount before calling SafeERC20.safeTransferFrom.

Proof of Concept (PoC)

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;

import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";

// Mock contract to simulate the `liquidateLstBorrower` function with the missing allowance check
contract LstLiquidation {

    using SafeERC20 for IERC20;

    address public lstToken;

    constructor(address _lstToken) {
        lstToken = _lstToken;
    }

    /**
     * @notice Simulate liquidateLstBorrower function
     * @param _borrower Borrower address
     * @param _lstAmount Amount of LST tokens to be liquidated
     */
    function liquidateLstBorrower(address _borrower, uint256 _lstAmount) external {
        // Missing allowance check (the vulnerability)
        SafeERC20.safeTransferFrom(
            IERC20(lstToken),
            msg.sender,
            address(this),
            _lstAmount
        );

        // Proceed with liquidation logic (mocked)
        // This part would perform liquidation logic (mocked for PoC purposes)
    }
}

A user attempts to call liquidateLstBorrower with lstAmount but has not previously approved the contract to transfer lstAmount of LST tokens.
The transaction fails at the SafeERC20.safeTransferFrom line due to insufficient allowance, halting the liquidation.

Recommendations

Add an explicit check for sufficient allowance before calling SafeERC20.safeTransferFrom.
Example:

require(IERC20(address(lstToken)).allowance(msg.sender, address(this)) >= lstAmount, "Insufficient allowance");