handsomegiraffe - Malicious liquidity provider can prevent liquidation of loan and loss of funds to other liquidity providers

[sherlock-admin]

handsomegiraffe

high

Malicious liquidity provider can prevent liquidation of loan and loss of funds to other liquidity providers

Summary

By supplying a loan and burning the Univswap V3 position after, a malicious liquidity provider can cause DOS to real wagmi and prevent liquidation of loan(s) and loss of funds to other liquidity providers.

Vulnerability Detail

A malicious liquidity provider could approve real wagmi to use his position for loans. After supplying the loan, the malicious actor could then burn their Uniswap V3 position NFT. This prevents repayment or liquidation of a loan, even through the emergency mode.

In the regular repayment/liquidation process, when _upRestoreLiquidityCache() is called, this external call :
underlyingPositionManager.positions(loan.tokenId); reverts with 'Invalid Token Id".

In the emergency process, when _calculateEmergencyLoanClosure() is called, this external call :
address creditor = underlyingPositionManager.ownerOf(loan.tokenId);reverts with 'ERC721: owner query for nonexistent token'.

Proof of Concept

In WagmiLeverageTests.ts, bob provides a WETH_USDT loan with tokenId 512099. As all liquidity is used for loans, by inserting await nonfungiblePositionManager.connect(bob).burn(nftpos[1].tokenId); before repay is called, these tests will fail :

1. it("emergency repay will be successful for PosManNFT owner if the collateral is depleted") (L990)
2. it("Loan liquidation will be successful for anyone if the collateral is depleted") (L1071)

Impact

As a result of the DOS,

• Liquidation of the loan not possible, significant funds loss/stuck
• Honest liquidity providers are unable to recover funds supplied to the loan (up to 7 per position)
• An honest borrower is unable to repay, close the loan and recover collateral

Code Snippet

https://github.com/sherlock-audit/2023-10-real-wagmi/blob/main/wagmi-leverage/contracts/abstract/LiquidityManager.sol#L494

https://github.com/sherlock-audit/2023-10-real-wagmi/blob/main/wagmi-leverage/contracts/abstract/LiquidityManager.sol#L494

Tool used

Manual Review

Recommendation

Suggest to wrap external calls to underlyingPositionManager in try/catch and handle reverts by writing off loan from that specific liquidity position which has been burned.

Duplicate of #78