cergyk - BBCommon::_accrue wrong value is used to prevent overflow

[sherlock-admin2]

cergyk

medium

BBCommon::_accrue wrong value is used to prevent overflow

Summary

A mechanism is used in _accrue, to prevent overflow in order to avoid Dos on multiple entrypoints of a BigBang market (many external functions call on _accrue before executing their logic). However the wrong value is used to prevent an overflow, and even though it could be prevented the first time, it should overflow the second one it is called

Vulnerability Detail

We can see that the value to be accrued is clamped to type(uint128).max - totalBorrowCap

Which works the first time to avoid an overflow since totalBorrow.elastic should be less than totalBorrowCap. However if totalBorrow.elastic is already bigger than totalBorrowCap (due to a previous accrual), this clamping does not prevent overflow.

Impact

_accrue can still revert due to an overflow blocking most of the functions of a BigBang market.

Code Snippet

Tool used

Manual Review

Recommendation

Clamp accrued value to type(uint128).max - totalBorrow.elastic instead

[cryptotechmaker]

Fixed by Tapioca-DAO/Tapioca-bar#351

[sherlock-admin4]

The protocol team fixed this issue in PR/commit Tapioca-DAO/Tapioca-bar#351.