Rebasing tokens are not supported

[code423n4]

Lines of code

https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/Lendgine.sol#L144
https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/libraries/Position.sol#L51

Vulnerability details

Impact

Rebasing tokens are not supported. Pool can be insolvent.

Proof of Concept

When depositor accrues interests, his tokensOwed amount is updated inside Position.update function.
https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/libraries/Position.sol#L38-L65

  function update(
    mapping(address => Position.Info) storage self,
    address owner,
    int256 sizeDelta,
    uint256 rewardPerPosition
  )
    internal
  {
    Position.Info storage positionInfo = self[owner];
    Position.Info memory _positionInfo = positionInfo;


    uint256 tokensOwed;
    if (_positionInfo.size > 0) {
      tokensOwed = newTokensOwed(_positionInfo, rewardPerPosition);
    }


    uint256 sizeNext;
    if (sizeDelta == 0) {
      if (_positionInfo.size == 0) revert NoPositionError();
      sizeNext = _positionInfo.size;
    } else {
      sizeNext = PositionMath.addDelta(_positionInfo.size, sizeDelta);
    }


    if (sizeDelta != 0) positionInfo.size = sizeNext;
    positionInfo.rewardPerPositionPaid = rewardPerPosition;
    if (tokensOwed > 0) positionInfo.tokensOwed = _positionInfo.tokensOwed + tokensOwed;
  }

As you can see interests are accrued as newTokensOwed and they are saved as collateral token value that should be paid for user.
Later he can call Lendgine.collect in order to receive interests.
https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/Lendgine.sol#L194-L206

  function collect(address to, uint256 collateralRequested) external override nonReentrant returns (uint256 collateral) {
    Position.Info storage position = positions[msg.sender]; // SLOAD
    uint256 tokensOwed = position.tokensOwed;


    collateral = collateralRequested > tokensOwed ? tokensOwed : collateralRequested;


    if (collateral > 0) {
      position.tokensOwed = tokensOwed - collateral; // SSTORE
      SafeTransferLib.safeTransfer(token1, to, collateral);
    }


    emit Collect(msg.sender, to, collateral);
  }

In case when rebasing token will be used as collateral such approach will not work as at the moment when tokensOwed was increased by value X of rebasing token, this value can become Y < X, when user calls collect. As result he will receive more tokens from the pool that he should. In case if token increased in price, then user will receive less tokens as interests.

Tools Used

VsCode

Recommended Mitigation Steps

I believe that factory should have list if whitelisted tokens that can be used by protocol. Currently any token can be used.

[c4-judge]

berndartmueller marked the issue as duplicate of #263

[c4-judge]

berndartmueller marked the issue as satisfactory