MiloTruck - Borrower's reputation mark becomes permanent if his loan is defaulted and claimed by lender

[sherlock-admin]

MiloTruck

medium

Borrower's reputation mark becomes permanent if his loan is defaulted and claimed by lender

Summary

Borrowers' reputation are not updated if a lender claims their defaulted loan, which will affect their reputation negatively forever.

Vulnerability Detail

In TellerV2.sol, if a loan is repaid or liquidated, the borrower's reputation mark is removed in the _repayLoan() function:

TellerV2.sol#L758-L761

        // If the loan is paid in full and has a mark, we should update the current reputation
        if (mark != RepMark.Good) {
            reputationManager.updateAccountReputation(bid.borrower, _bidId);
        }

As the ReputationManager.updateAccountReputation() function fetches a borrower's active bids using getBorrowerActiveLoanIds(), the bid is also removed from _borrowerBidsActive to prevent it from ever affecting the borrower's reputation in the future:

TellerV2.sol#L731-L732

            // Remove borrower's active bid
            _borrowerBidsActive[bid.borrower].remove(_bidId);

However, if the lender of a defaulted loan claims its collateral through the CollateralManager.withdraw() function, the borrower's reputation is not updated, and the bid is never removed from _borrowerBidsActive. This will cause the borrower to have a permanent defaulted loan in his reputation whenever someone calls ReputationManager.getDefaultedLoanIds().

Impact

Borrowers will have a permanent defaulted loan in their reputation for every defaulted loan that is claimed by a lender. This might cause them to be unable to get loans in the future as lenders rely on the reputation system to determine whose bids to accept.

Code Snippet

• https://github.com/teller-protocol/teller-protocol-v2/blob/cb66c9e348cdf1fd6d9b0416a49d663f5b6a693c/packages/contracts/contracts/TellerV2.sol#L758-L761
• https://github.com/teller-protocol/teller-protocol-v2/blob/cb66c9e348cdf1fd6d9b0416a49d663f5b6a693c/packages/contracts/contracts/TellerV2.sol#L731-L732

Tool used

Manual Review

Recommendation

In the CollateralManager.withdraw() function, consider updating the borrower's reputation and removing the bid from _borrowerBidsActive.

[ethereumdegen]

Thank you for your response. You are right; when the lender claims collateral right now there is not a hook that updates the state on TellerV2 so the defaulted loan will remain on the borrowers record permanently. We are not going to change this at this time.