Sherlock 145: Take adjustments: msg.sender provides QT instead of _callee

src/ERC20Pool.sol

@@ -405,7 +405,7 @@ contract ERC20Pool is FlashloanablePool, IERC20Pool {
  );
  }
 
- _transferQuoteTokenFrom(callee_, result.quoteTokenAmount);
+ _transferQuoteTokenFrom(msg.sender, result.quoteTokenAmount);
  }
 
  /**

src/ERC721Pool.sol

@@ -460,7 +460,7 @@ contract ERC721Pool is FlashloanablePool, IERC721Pool {
  if (result.settledAuction) _rebalanceTokens(borrowerAddress_, result.remainingCollateral);
 
  // transfer from taker to pool the amount of quote tokens needed to cover collateral auctioned (including excess for rounded collateral)
- _transferQuoteTokenFrom(callee_, totalQuoteTokenAmount);
+ _transferQuoteTokenFrom(msg.sender, totalQuoteTokenAmount);
 
  // transfer from pool to borrower the excess of quote tokens after rounding collateral auctioned
  if (result.excessQuoteToken != 0) _transferQuoteToken(borrowerAddress_, result.excessQuoteToken);

tests/forge/interactions/ERC20TakeWithExternalLiquidity.t.sol

@@ -132,4 +132,27 @@ contract ERC20TakeWithExternalLiquidityTest is Test {
  // confirm we earned some quote token
  assertGt(usdc.balanceOf(address(taker)), 0);
  }
+
+ function testTakeCalleeDiffersFromSender() external {
+
+ // _lender is msg.sender, QT & CT balances pre take
+ assertEq(usdc.balanceOf(_lender), 119_999.999999926999804658 * 1e18);
+ assertEq(weth.balanceOf(_lender), 0);
+
+ // callee, _lender1 QT & CT balances pre take
+ assertEq(usdc.balanceOf(_lender1), 120_000.0 * 1e18);
+ assertEq(weth.balanceOf(_lender1), 4.0 * 1e18);
+
+ // lender calls take, passing _lender1 as the callee
+ changePrank(_lender);
+ _ajnaPool.take(_borrower, 1_001 * 1e18, _lender1, new bytes(0));
+
+ // _lender is has QT deducted from balance
+ assertEq(usdc.balanceOf(_lender), 119_999.999999926985301196 * 1e18);
+ assertEq(weth.balanceOf(_lender), 0);
+
+ // callee, _lender1 receives CT from take
+ assertEq(usdc.balanceOf(_lender1), 120_000.0 * 1e18);
+ assertEq(weth.balanceOf(_lender1), 6.0 * 1e18);
+ }
 }

tests/forge/interactions/ERC721TakeWithExternalLiquidity.sol

@@ -88,4 +88,35 @@ contract ERC721TakeWithExternalLiquidityTest is ERC721HelperContract {
  // confirm we earned some quote token
  assertEq(_quote.balanceOf(address(taker)), 970.423096682230524352 * 1e18);
  }
+
+ function testTakeNFTCalleeDiffersFromSender() external { 
+ // instantiate and fund a hypothetical NFT marketplace
+ NFTMarketPlace marketPlace = new NFTMarketPlace(_quote);
+ deal(address(_quote), address(marketPlace), 25_000 * 1e18);
+
+ // instantiate a taker contract which implements IERC721Taker and uses this marketplace
+ NFTTakeExample taker = new NFTTakeExample(address(marketPlace));
+ changePrank(address(taker));
+ assertEq(_quote.balanceOf(address(taker)), 0);
+ _quote.approve(address(_pool), type(uint256).max);
+ _collateral.setApprovalForAll(address(marketPlace), true);
+
+ // _lender is msg.sender, QT & CT balances pre take
+ assertEq(_quote.balanceOf(_lender), 49_979.825641778370686641 * 1e18);
+ assertEq(_quote.balanceOf(address(taker)), 0);
+
+ // call take using taker contract
+ changePrank(_lender);
+ bytes memory data = abi.encode(address(_pool));
+ vm.expectEmit(true, true, false, true);
+ uint256 quoteTokenPaid = 529.576903317769475648 * 1e18;
+ uint256 collateralPurchased = 2 * 1e18;
+ uint256 bondChange = 5.295769033177694756 * 1e18;
+ emit Take(_borrower, quoteTokenPaid, collateralPurchased, bondChange, true);
+ _pool.take(_borrower, 2, address(taker), data);
+
+ // _lender is msg.sender, QT & CT balances post take
+ assertEq(_quote.balanceOf(_lender), 49_450.248738460601210993 * 1e18);
+ assertEq(_quote.balanceOf(address(taker)), 1_500.0 * 1e18); // QT is increased as NFTTakeExample contract sells the NFT
+ }
 }