Skip to content

Latest commit

 

History

History
88 lines (55 loc) · 3.55 KB

092.md

File metadata and controls

88 lines (55 loc) · 3.55 KB
Raw

Rare Emerald Sealion

Medium

Borrower can create risk free position, leading to long term loss for lender.

Summary

Predictdotfun allows lenders to provide USDC for CTF tokens as collateral. When creating a loan, the lender will decide on a duration and in case the borrower does not repay, seize the collateral.

Following problem arises for volatile markets: In case the price of one CTF token drops below what the lender has loaned to the borrower, there is no reason to repay the loan. The borrower will default leading to a loss for the lender.

This can be exploited by taking two loans on both YES and NO tokens (assuming a binary market).

The only real protection the lender has against this, is to keep a really high C/L ratio. (In some cases > 500%)

This makes borrowing nearly useless.

Root Cause

The root cause of this issue is not allow liquidations of loans in case the collateral value drops below the loan amount.

Seizing collateral after the loan ends, does not ensure that its not worthless at the end of the loan.

Currently the call function will always revert in case the loan is not matured yet:

        if (loan.startTime + loan.minimumDuration > block.timestamp) {
            revert LoanNotMatured();
        }

https://github.com/sherlock-audit/2024-09-predict-fun/blob/main/predict-dot-loan/contracts/PredictDotLoan.sol#L540-L542

Internal pre-conditions

There are no internal pre conditions.

External pre-conditions

The price of a yes/no token drops under the loan amount, this can mean a drop in price of 10% or 90%, depending on the C/L ratio. Also there needs to be loan offers for both yes and no tokens. Assuming the market is trading at the same price, this is likely.

Attack Path

Following attack will long term drain funds from lenders:

Assume there is market that trades at 50/50 at first, but can change dramatically. (Politics, Finance)

Price of Yes and No token is 0.5 USD.

Now someone creates a loan offer for 0.4 USD per Yes and No token. This means the loan is collateralized by 125% at time of creation. In case the protocol wants to support higher leverage a fairly low collateralization rate is required.

Borrower mints 100 yes and no tokens for 100 USD.

He borrows 40 USD for yes, and 40 USD for no.

After the market moves more then 20% in any direction. So for example the price of yes tokens is 0.7 USD.

This allows the borrower to close his position of borrowed "yes" and will result in 110 USD balance (10 USD profit).

Impact

Long term, lenders will be drained out of funds. They dont have any edge against borrowers in the system.

C/L of: 200% Price on Date 0 Price on Date 1 Borrow amount on Date 0 USDC Amount by borrow Value of Collateral on Date 1 Total Position Value after repaying only profitable Profit
Yes 0,5 0,95 0,25 25 95 95 15
No 0,5 0,05 0,25 25 5 25  
C/L of: 200%              
Yes 0,7 0,4 0,35 35 40 40 0
No 0,3 0,6 0,15 15 60 60  
C/L of: 125%              
Yes 0,5 0,75 0,4 40 75 75 15
No 0,5 0,25 0,4 40 25 40  

Following Table shows different cases in which the borrower always wins. These do not include protocol fee (can be 0) and interest rate. In case of the example, the interest rate would have to be higher then 15% for the timespan of the loan, which is unrealistic, to not allow borrower to profit.

Mitigation

For better efficiency the protocol should allow liquidations based on market price.