Skip to content

Latest commit

 

History

History
41 lines (19 loc) · 1.69 KB

100.md

File metadata and controls

41 lines (19 loc) · 1.69 KB
Raw

Careful Pistachio Bat

Medium

Lack of Ownership Validation Between Loan Offers and Orders

Summary

The protocol's lack of verification between the ownership of orders and loan offers allows attackers to exploit some users who provide liquidity to the protocol. An attacker can fill a user's order using their own loan offer without intending to repay, effectively locking the user's funds for the duration of the loan, without providing any collateral.

Root Cause

The protocol fails to verify that the owner of an order and the loan offer being filled are the same

https://github.com/sherlock-audit/2024-09-predict-fun/blob/41e70f9eed3f00dd29aba4038544150f5b35dccb/predict-dot-loan/contracts/PredictDotLoan.sol#L214

Attack Path

  1. Alice is attempting to earn profits on the Predict.fun protocol as a liquidity provider (LP) by maintaining open orders and loan offers.

  2. Bob, however, is not interested in participating in lending activities.

  3. Observing Alice's open orders and loan offers, he sees an opportunity.

  4. Bob pays a minimal gas fee to fill Alice's order using his own loan offer.

  5. As a result, Alice's CT tokens become locked in the protocol for the duration of the loan, which Bob has no intention of repaying.

  6. Meanwhile, legitimate users who wish to borrow from Alice are unable to do so, as her funds are already tied up in the protocol.

Impact

This exposes some users to potential financial losses while the attacker remains risk-free, leading to locked collateral and disruption in market liquidity.

Mitigation

Enforce checks to ensure that the owner of an order and a corresponding loan offer are not the same before allowing any transaction that fills the order.