Malicious lender can claim revenue and steal it from borrower

[code423n4]

Lines of code

https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/SpigotedLine.sol#L93-L133

Vulnerability details

Impact

Lender can use swap data with no slippage and sandwich attakc to steal claimed revenue and extract more value from borrower

Proof of Concept

uint256 newTokens = claimToken == credit.token ?
    spigot.claimEscrow(claimToken) :  // same asset. dont trade
    _claimAndTrade(                   // trade revenue token for debt obligation
        claimToken,
        credit.token,
        zeroExTradeData
    );

uint256 repaid = newTokens + unusedTokens[credit.token];
uint256 debt = credit.interestAccrued + credit.principal;

SpigotedLine#claimAndRepay allows the lender to claim and swap revenue tokens to pay borrower debt. Caller is allowed to provide arbitrary swap data allowing a malicious lender to claim revenue and then steal it by using no slippage bounds and sandwiching the trade. This allows the lender to extract more value from the borrower.

Tools Used

Manual Review

Recommended Mitigation Steps

Only borrower should be allowed to claim and swap if the credit token because lender has no incentive to get borrower a good swap price.

[c4-judge]

dmvt marked the issue as duplicate of #88

[c4-judge]

dmvt marked the issue as partial-50

[c4-judge]

dmvt changed the severity to 2 (Med Risk)

[C4-Staff]

captainmangoC4 marked the issue as duplicate of #110