Bauer - Does not consider that the difference in precision between loan token and collateral token may cause the user will be not able to borrow tokens.

[github-actions]

Bauer

high

Does not consider that the difference in precision between loan token and collateral token may cause the user will be not able to borrow tokens.

Summary

The protocol does not consider that the difference in precision between loan token and collateral token , if the loan token is WETH ( the decimal of WETH is 18) and collateral token is USDT (the decimal of WETH is 6). user will be not able to borrow loan tokens.

Vulnerability Detail

The protocol allows user to add collateral tokens and borrow loan tokens. When user call the function borrow() to borrow loan tokens ,the protocol will calculate user collateral ratio and the ratio should less than _currentCollateralRatioMantissa. The userCollateralRatioMantissa is calculated according to this formula uint userCollateralRatioMantissa = userDebt * 1e18 / collateralBalanceOf[msg.sender];. However, if the loan token is WETH ( the decimal of WETH is 18) and collateral token is USDT (the decimal of WETH is 6). The user collateral ratio will be userCollateralRatioMantissa = x*1e18*1e18/y1e6. The decimal of result will be 30 and it is greater than _currentCollateralRatioMantissa (the decimals is 18). User will be not able to complete the borrowing.

  function borrow(uint amount) external {
        uint _loanTokenBalance = LOAN_TOKEN.balanceOf(address(this));
        (address _feeRecipient, uint _feeMantissa) = FACTORY.getFee();
        (  
            uint _currentTotalSupply,
            uint _accruedFeeShares,
            uint _currentCollateralRatioMantissa,
            uint _currentTotalDebt
        ) = getCurrentState(
            _loanTokenBalance,
            _feeMantissa,
            lastCollateralRatioMantissa,
            totalSupply,
            lastAccrueInterestTime,
            lastTotalDebt
        );

        uint _debtSharesSupply = debtSharesSupply;
        uint userDebt = getDebtOf(debtSharesBalanceOf[msg.sender], _debtSharesSupply, _currentTotalDebt) + amount;
        uint userCollateralRatioMantissa = userDebt * 1e18 / collateralBalanceOf[msg.sender];
        require(userCollateralRatioMantissa <= _currentCollateralRatioMantissa, "Pool: user collateral ratio too high");

        uint _newUtil = getUtilizationMantissa(_currentTotalDebt + amount, (_currentTotalDebt + _loanTokenBalance));
        require(_newUtil <= SURGE_MANTISSA, "Pool: utilization too high");

Impact

Users will be not able to complete the borrowing.

Code Snippet

https://github.com/sherlock-audit/2023-02-surge/blob/main/surge-protocol-v1/src/Pool.sol#L455-L498

Tool used

Manual Review

Recommendation

Depending on the precision of each Token, the ratio is calculated dynamically

Duplicate of #122