This repository has been archived by the owner on Mar 3, 2024. It is now read-only.
klaus - At claimDefaulted, the lender may not receive the token because the Unclaimed token is not processed #119
Labels
Has Duplicates
A valid issue with 1+ other issues describing the same vulnerability
High
A valid High severity issue
Reward
A payout will be made for this issue
Sponsor Confirmed
The sponsor acknowledged this issue is valid
Will Fix
The sponsor confirmed this issue will be fixed
Comments
github-actions
bot
added
High
This was referenced Sep 1, 2023
deadrxsezzz - If
claimDefaulted is called before claimRepaid all of loan.unclaimed will be lost
#248
Closed
ohmzeus
added a commit
to ohmzeus/Cooler
that referenced
this issue
Sep 5, 2023
Summary: At claimDefaulted, the lender may not receive the token because the Unclaimed token is not processed Issue Link: sherlock-audit/2023-08-cooler-judging#119 Fix Description: Set amount and collateral to zero but do not delete loan struct.
0xrusowsky
added
Sponsor Confirmed
sherlock-admin
changed the title
|
Fix approved. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
klaus
medium
At claimDefaulted, the lender may not receive the token because the Unclaimed token is not processed
Summary
claimDefaulteddoes not handleloan.unclaimed. This preventing the lender from receiving the debt repayment.Vulnerability Detail
Loan data is deletead in
claimDefaultedfunction.loan.unclaimedis not checked before data deletead. So, ifclaimDefaultedis called while there are unclaimed tokens, the lender will not be able to get the unclaimed tokens.Impact
Lender cannot get unclaimed token.
Code Snippet
https://github.com/sherlock-audit/2023-08-cooler/blob/6d34cd12a2a15d2c92307d44782d6eae1474ab25/Cooler/src/Cooler.sol#L318-L320
Tool used
Manual Review
Recommendation
Process unclaimed tokens before deleting loan data.
function claimDefaulted(uint256 loanID_) external returns (uint256, uint256, uint256) { + claimRepaid(loanID_) Loan memory loan = loans[loanID_]; delete loans[loanID_];The text was updated successfully, but these errors were encountered: